|
Server : Apache/2.2.2 (Fedora) System : Linux App1.pathumtani.go.th 2.6.20-1.2320.fc5smp #1 SMP Tue Jun 12 19:40:16 EDT 2007 i686 User : apache ( 48) PHP Version : 5.2.9 Disable Function : NONE Directory : /proc/self/root/usr/share/doc/postgresql-8.1.9/html/ |
Upload File : |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <HTML ><HEAD ><TITLE >Database Roles and Privileges</TITLE ><META NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK REV="MADE" HREF="mailto:pgsql-docs@postgresql.org"><LINK REL="HOME" TITLE="PostgreSQL 8.1.9 Documentation" HREF="index.html"><LINK REL="UP" TITLE="Server Administration" HREF="admin.html"><LINK REL="PREVIOUS" TITLE="Short Options" HREF="runtime-config-short.html"><LINK REL="NEXT" TITLE="Role Attributes" HREF="role-attributes.html"><LINK REL="STYLESHEET" TYPE="text/css" HREF="stylesheet.css"><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=ISO-8859-1"><META NAME="creation" CONTENT="2007-04-20T04:40:08"></HEAD ><BODY CLASS="CHAPTER" ><DIV CLASS="NAVHEADER" ><TABLE SUMMARY="Header navigation table" WIDTH="100%" BORDER="0" CELLPADDING="0" CELLSPACING="0" ><TR ><TH COLSPAN="5" ALIGN="center" VALIGN="bottom" >PostgreSQL 8.1.9 Documentation</TH ></TR ><TR ><TD WIDTH="10%" ALIGN="left" VALIGN="top" ><A HREF="runtime-config-short.html" ACCESSKEY="P" >Prev</A ></TD ><TD WIDTH="10%" ALIGN="left" VALIGN="top" ><A HREF="runtime-config.html" >Fast Backward</A ></TD ><TD WIDTH="60%" ALIGN="center" VALIGN="bottom" ></TD ><TD WIDTH="10%" ALIGN="right" VALIGN="top" ><A HREF="managing-databases.html" >Fast Forward</A ></TD ><TD WIDTH="10%" ALIGN="right" VALIGN="top" ><A HREF="role-attributes.html" ACCESSKEY="N" >Next</A ></TD ></TR ></TABLE ><HR ALIGN="LEFT" WIDTH="100%"></DIV ><DIV CLASS="CHAPTER" ><H1 ><A NAME="USER-MANAG" ></A >Chapter 18. Database Roles and Privileges</H1 ><DIV CLASS="TOC" ><DL ><DT ><B >Table of Contents</B ></DT ><DT >18.1. <A HREF="user-manag.html#DATABASE-ROLES" >Database Roles</A ></DT ><DT >18.2. <A HREF="role-attributes.html" >Role Attributes</A ></DT ><DT >18.3. <A HREF="privileges.html" >Privileges</A ></DT ><DT >18.4. <A HREF="role-membership.html" >Role Membership</A ></DT ><DT >18.5. <A HREF="perm-functions.html" >Functions and Triggers</A ></DT ></DL ></DIV ><P > <SPAN CLASS="PRODUCTNAME" >PostgreSQL</SPAN > manages database access permissions using the concept of <I CLASS="FIRSTTERM" >roles</I >. A role can be thought of as either a database user, or a group of database users, depending on how the role is set up. Roles can own database objects (for example, tables) and can assign privileges on those objects to other roles to control who has access to which objects. Furthermore, it is possible to grant <I CLASS="FIRSTTERM" >membership</I > in a role to another role, thus allowing the member role use of privileges assigned to the role it is a member of. </P ><P > The concept of roles subsumes the concepts of <SPAN CLASS="QUOTE" >"users"</SPAN > and <SPAN CLASS="QUOTE" >"groups"</SPAN >. In <SPAN CLASS="PRODUCTNAME" >PostgreSQL</SPAN > versions before 8.1, users and groups were distinct kinds of entities, but now there are only roles. Any role can act as a user, a group, or both. </P ><P > This chapter describes how to create and manage roles and introduces the privilege system. More information about the various types of database objects and the effects of privileges can be found in <A HREF="ddl.html" >Chapter 5</A >. </P ><DIV CLASS="SECT1" ><H1 CLASS="SECT1" ><A NAME="DATABASE-ROLES" >18.1. Database Roles</A ></H1 ><A NAME="AEN21056" ></A ><A NAME="AEN21058" ></A ><A NAME="AEN21060" ></A ><A NAME="AEN21062" ></A ><P > Database roles are conceptually completely separate from operating system users. In practice it might be convenient to maintain a correspondence, but this is not required. Database roles are global across a database cluster installation (and not per individual database). To create a role use the <A HREF="sql-createrole.html" ><I >CREATE ROLE</I ></A > SQL command: </P><PRE CLASS="SYNOPSIS" >CREATE ROLE <TT CLASS="REPLACEABLE" ><I >name</I ></TT >;</PRE ><P> <TT CLASS="REPLACEABLE" ><I >name</I ></TT > follows the rules for SQL identifiers: either unadorned without special characters, or double-quoted. (In practice, you will usually want to add additional options, such as <TT CLASS="LITERAL" >LOGIN</TT >, to the command. More details appear below.) To remove an existing role, use the analogous <A HREF="sql-droprole.html" ><I >DROP ROLE</I ></A > command: </P><PRE CLASS="SYNOPSIS" >DROP ROLE <TT CLASS="REPLACEABLE" ><I >name</I ></TT >;</PRE ><P> </P ><A NAME="AEN21073" ></A ><A NAME="AEN21075" ></A ><P > For convenience, the programs <A HREF="app-createuser.html" ><SPAN CLASS="APPLICATION" >createuser</SPAN ></A > and <A HREF="app-dropuser.html" ><SPAN CLASS="APPLICATION" >dropuser</SPAN ></A > are provided as wrappers around these SQL commands that can be called from the shell command line: </P><PRE CLASS="SYNOPSIS" >createuser <TT CLASS="REPLACEABLE" ><I >name</I ></TT > dropuser <TT CLASS="REPLACEABLE" ><I >name</I ></TT ></PRE ><P> </P ><P > To determine the set of existing roles, examine the <TT CLASS="STRUCTNAME" >pg_roles</TT > system catalog, for example </P><PRE CLASS="SYNOPSIS" >SELECT rolname FROM pg_roles;</PRE ><P> The <A HREF="app-psql.html" ><SPAN CLASS="APPLICATION" >psql</SPAN ></A > program's <TT CLASS="LITERAL" >\du</TT > meta-command is also useful for listing the existing roles. </P ><P > In order to bootstrap the database system, a freshly initialized system always contains one predefined role. This role is always a <SPAN CLASS="QUOTE" >"superuser"</SPAN >, and by default (unless altered when running <TT CLASS="COMMAND" >initdb</TT >) it will have the same name as the operating system user that initialized the database cluster. Customarily, this role will be named <TT CLASS="LITERAL" >postgres</TT >. In order to create more roles you first have to connect as this initial role. </P ><P > Every connection to the database server is made in the name of some particular role, and this role determines the initial access privileges for commands issued on that connection. The role name to use for a particular database connection is indicated by the client that is initiating the connection request in an application-specific fashion. For example, the <TT CLASS="COMMAND" >psql</TT > program uses the <TT CLASS="OPTION" >-U</TT > command line option to indicate the role to connect as. Many applications assume the name of the current operating system user by default (including <TT CLASS="COMMAND" >createuser</TT > and <TT CLASS="COMMAND" >psql</TT >). Therefore it is often convenient to maintain a naming correspondence between roles and operating system users. </P ><P > The set of database roles a given client connection may connect as is determined by the client authentication setup, as explained in <A HREF="client-authentication.html" >Chapter 20</A >. (Thus, a client is not necessarily limited to connect as the role with the same name as its operating system user, just as a person's login name need not match her real name.) Since the role identity determines the set of privileges available to a connected client, it is important to carefully configure this when setting up a multiuser environment. </P ></DIV ></DIV ><DIV CLASS="NAVFOOTER" ><HR ALIGN="LEFT" WIDTH="100%"><TABLE SUMMARY="Footer navigation table" WIDTH="100%" BORDER="0" CELLPADDING="0" CELLSPACING="0" ><TR ><TD WIDTH="33%" ALIGN="left" VALIGN="top" ><A HREF="runtime-config-short.html" ACCESSKEY="P" >Prev</A ></TD ><TD WIDTH="34%" ALIGN="center" VALIGN="top" ><A HREF="index.html" ACCESSKEY="H" >Home</A ></TD ><TD WIDTH="33%" ALIGN="right" VALIGN="top" ><A HREF="role-attributes.html" ACCESSKEY="N" >Next</A ></TD ></TR ><TR ><TD WIDTH="33%" ALIGN="left" VALIGN="top" >Short Options</TD ><TD WIDTH="34%" ALIGN="center" VALIGN="top" ><A HREF="admin.html" ACCESSKEY="U" >Up</A ></TD ><TD WIDTH="33%" ALIGN="right" VALIGN="top" >Role Attributes</TD ></TR ></TABLE ></DIV ></BODY ></HTML >