Am Donnerstag, 21. Juli 2005 22:55 schrieb Tom Lane:
> What this says is that when a role A is a member of another role B, A
> automatically has all of B's privileges. But when a user U is a member
> of role R, U does *not* have R's privileges automatically. What he has
> is the right to do SET ROLE R, after which he has R's privileges in
> addition to his own (see the rest of 4.31.4).
>
> This is ... um ... a pretty bizarre way of looking at security.
> U can in fact do whatever his roles allow him to do, he just needs to
> say "Mother may I?" first.
In some circles, this is considered the standard behavior of role security
models. (There is a NIST standard somewhere.) It allows (with additional
work) dynamic separation of concerns, namely that you could be a member of
roles A and B but cannot use both at the same time. This is admittedly a
fairly advanced feature, but should nevertheless be kept in mind.
--
Peter Eisentraut
http://developer.postgresql.org/~petere/
