From b4794bfb541f1eb4507d45abbfae8ad00ebae1ce Mon Sep 17 00:00:00 2001 From: Bruce Momjian Date: Fri, 16 Aug 2002 04:47:43 +0000 Subject: [PATCH] This patch improves the "Database Users and Permissions" section of the Administrator's Guide. This section needs a lot more work, but this is a start anyway... Neil Conway --- doc/src/sgml/user-manag.sgml | 84 ++++++++++++++++++++---------------- 1 file changed, 47 insertions(+), 37 deletions(-) diff --git a/doc/src/sgml/user-manag.sgml b/doc/src/sgml/user-manag.sgml index 2103122cfe..27a6512174 100644 --- a/doc/src/sgml/user-manag.sgml +++ b/doc/src/sgml/user-manag.sgml @@ -1,10 +1,14 @@ - + + + Database Users and Permissions Managing database users and their privileges is in concept similar - to managing users of a Unix operating system, but the details are not - identical. + to managing the users of a Unix operating system, but the details + are not identical. @@ -27,8 +31,8 @@ CREATE USER name - For convenience, the shell scripts createuser - and dropuser are provided as wrappers around these SQL + For convenience, the shell scripts createuser + and dropuser are provided as wrappers around these SQL commands. @@ -36,18 +40,18 @@ CREATE USER name In order to bootstrap the database system, a freshly initialized system always contains one predefined user. This user will have the fixed id 1, and by default (unless altered when running - initdb) it will have the same name as the - operating system user that initialized the area (and is presumably - being used as the user that runs the server). Customarily, this user - will be named postgres. In order to create more - users you first have to connect as this initial user. + initdb) it will have the same name as + the operating system user that initialized the database + cluster. Customarily, this user will be named + postgres. In order to create more users + you first have to connect as this initial user. The user name to use for a particular database connection is indicated by the client that is initiating the connection request in an application-specific fashion. For example, the - psql program uses the + psql program uses the command line option to indicate the user to connect as. The set of database users a given client connection may connect as is determined by the client authentication setup, as explained in @@ -71,7 +75,7 @@ CREATE USER name A database superuser bypasses all permission checks. Also, only a superuser can create new users. To create a database - superuser, use CREATE USER name + superuser, use CREATE USER name CREATEUSER. @@ -83,8 +87,8 @@ CREATE USER name A user must be explicitly given permission to create databases (except for superusers, since those bypass all permission - checks). To create such a user, use CREATE USER name - CREATEDB. + checks). To create such a user, use CREATE USER + name CREATEDB. @@ -93,11 +97,14 @@ CREATE USER name password - A password is only significant if password authentication is - used for client authentication. Database passwords are separate - from operating system passwords. Specify a password upon - user creation with CREATE USER name PASSWORD - 'string'. + A password is only significant if the client authentication + method requires the user to supply a password when connecting + to the database. At present, the @@ -134,26 +141,29 @@ ALTER GROUP name DROP USER uname1 When a database object is created, it is assigned an owner. The - owner is the user that executed the creation statement. There is - currently no polished interface for changing the owner of a database - object (except for tables, for which ALTER TABLE can do it). - By default, only an owner (or a superuser) can do anything - with the object. In order to allow other users to use it, - privileges must be granted. + owner is the user that executed the creation statement. To change + the owner of a table, index, sequence, or view, use the + ALTER TABLE command. By default, only an owner + (or a superuser) can do anything with the object. In order to allow + other users to use it, privileges must be + granted. - There are several different privileges: SELECT - (read), INSERT (append), UPDATE - (write), DELETE, RULE, - REFERENCES (foreign key), and - TRIGGER. (See the GRANT manual - page for more detailed information.) The right to modify or destroy - an object is always the privilege of the owner only. To assign - privileges, the GRANT command is used. So, if - joe is an existing user, and - accounts is an existing table, write access can be - granted with + There are several different privileges: SELECT, + INSERT, UPDATE, DELETE, + RULE, REFERENCES, TRIGGER, + CREATE, TEMPORARY, EXECUTE, + USAGE, and ALL PRIVILEGES. For more + information on the different types of privileges support by + PostgreSQL, refer to the + GRANT reference manual. The right to modify or + destroy an object is always the privilege of the owner only. To + assign privileges, the GRANT command is + used. So, if joe is an existing user, and + accounts is an existing table, the privilege to + update the table can be granted with + GRANT UPDATE ON accounts TO joe; @@ -210,4 +220,4 @@ REVOKE ALL ON accounts FROM PUBLIC; - + -- 2.40.0