List:Internals« Previous MessageNext Message »
From:Roy Lyseng Date:May 20 2008 9:21pm
Subject:Re: [Report 2] RBAC system - starting point
View as plain text  

Jeremy Cole wrote:
> Hi,
> 
>> To distinguish roles from users I propose to use "Host" field of
>> mysql.user table - If this field is empty then we should consider the
>> specified record to be a role.
> 
> I see all the discussion around this, but I would propose a different 
> tack: why not use a host which would otherwise be reserved?  The 
> similarity in functionality and such between users and roles is obvious, 
> but you don't want to break or change existing functionality.  How about 
> e.g. role "foo" would be equivalent to user "foo" @ "$role".  Since $ 
> (or @, #, &, ^, *, !, etc.) would never appear in a well-formed hostname 
> or IP address, they call all be used to mark a role as such.  The 
> commands to deal with roles would then really just be aliases on 
> user@"$role" and thus very easy to implement.

I do not think this is quite intuitive. A role is defined for all hosts, 
so the most explicit way of expressing this is to provide a 
wildcard-value in the host column (and having a user/role switch column 
to distinguish roles from users).

Thanks,
Roy
Thread
[Report 2] RBAC system - starting pointSergey Kudriavtsev20 May
  • Re: [Report 2] RBAC system - starting pointSergei Golubchik20 May
    • Re: [Report 2] RBAC system - starting pointKaren Abgarian20 May
      • Re: [Report 2] RBAC system - starting pointSergey Kudriavtsev20 May
        • Re: [Report 2] RBAC system - starting pointRoy Lyseng20 May
          • Re: [Report 2] RBAC system - starting pointSergei Golubchik21 May
    • Re: [Report 2] RBAC system - starting pointSergey Kudriavtsev20 May
      • Re: [Report 2] RBAC system - starting pointSergei Golubchik20 May
        • Re: [Report 2] RBAC system - starting pointSergey Kudriavtsev20 May
  • Re: [Report 2] RBAC system - starting pointMark Callaghan20 May
    • Re: [Report 2] RBAC system - starting pointSergey Kudriavtsev20 May
    • Re: [Report 2] RBAC system - starting pointRoy Lyseng20 May
      • Re: [Report 2] RBAC system - starting pointJeremy Cole20 May
  • Re: [Report 2] RBAC system - starting pointJeremy Cole20 May
    • Re: [Report 2] RBAC system - starting pointSergei Golubchik20 May
    • Re: [Report 2] RBAC system - starting pointVladimir Shebordaev20 May
      • Re: [Report 2] RBAC system - starting pointJeremy Cole20 May
        • Re: [Report 2] RBAC system - starting pointVladimir Shebordaev20 May
          • Re: [Report 2] RBAC system - starting pointJeremy Cole20 May
            • Re: [Report 2] RBAC system - starting pointVladimir Shebordaev21 May
              • Re: [Report 2] RBAC system - starting pointJeremy Cole21 May
      • Re: [Report 2] RBAC system - starting pointJeremy Cole20 May
    • Re: [Report 2] RBAC system - starting pointRoy Lyseng20 May
      • Re: [Report 2] RBAC system - starting pointJeremy Cole20 May
  • Re: [Report 2] RBAC system - starting pointJeremy Cole21 May
    • Re: [Report 2] RBAC system - starting pointVladimir Shebordaev21 May
      • Re: [Report 2] RBAC system - starting pointJeremy Cole21 May
        • Re: [Report 2] RBAC system - starting pointVladimir Shebordaev22 May
          • Re: [Report 2] RBAC system - starting pointEric Bergen22 May
            • Re: [Report 2] RBAC system - starting pointVladimir Shebordaev22 May
Re: [Report 2] RBAC system - starting pointJeremy Cole21 May