On 2010-02-25, Alex Hunsaker wrote: > You could create a base role that does not have connect privileges on > the other databases. Then just inherit from that role. Something like: > CREATE ROLE base_user; REVOKE CONNECT ON database from base_user; ... > > CREATE ROLE my_user inherit base_user; > Unfortunately, base_user inherits the connect privileges from role PUBLIC, regardless, whether it was created with NOINHERIT. > You could also go the other route and default deny connect databases > and explicitly allow connect. > That other way round seems to be the only solution for now, first revoke the CONNECT privileges from PUBLIC and then grant them to individual roles. How about changing the CREATEROLE privilege to be associated with a specific database instead of affecting all databases? -- Robert... -- Sent via pgsql-general mailing list (pgsql-general@xxxxxxxxxxxxxx) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-general
