Re: [JDBC] Thoughts on a Isolation/Security problem. - Mailing list pgsql-admin

From Markus Schaber
Subject Re: [JDBC] Thoughts on a Isolation/Security problem.
Date
Msg-id 4444B834.1030107@logix-tt.com
Whole thread Raw
In response to Thoughts on a Isolation/Security problem.  (Achilleus Mantzios <achill@matrix.gatewaynet.com>)
Responses Re: [JDBC] Thoughts on a Isolation/Security problem.  (Achilleus Mantzios <achill@matrix.gatewaynet.com>)
List pgsql-admin
Hi, Achilleus,

Achilleus Mantzios wrote:

> Now i am thinking of restructuring the whole architecture as:
> - Create one EAR app for every mgmt company
> - Create one DB USER for every mgmg company
> - Create one SCHEMA (same as the USER) for every mgmt company
> (mgmtcompany1,mgmtcompany2,etc...)

We're doing a very similar thing here for one of our legacy apps, which
luckily does not know anything about schemas, and so the search_path
trick does work.

However, for most "global" tables we have views with insert/update/
delete rules in the specific schemas, and such shield the application
from directly accessing the global data. We even need to mere local and
global data this way in some cases.

It is ugly, but it works fine and is manageable.

HTH,
Markus
--
Markus Schaber | Logical Tracking&Tracing International AG
Dipl. Inf.     | Software Development GIS

Fight against software patents in EU! www.ffii.org www.nosoftwarepatents.org

pgsql-admin by date:

Previous
From: Achilleus Mantzios
Date:
Subject: Thoughts on a Isolation/Security problem.
Next
From: Luckys
Date:
Subject: Re: [SQL] Thoughts on a Isolation/Security problem.