Re: Best way to manage users

On 1/4/06 1:55 PM, "Kevin Crenshaw" <kcrenshaw(at)viscient(dot)com> wrote:

> I think that I would have to disagree with the statement that 'Postgres will
> not do your user authentication for you'. If you have a pg user account for
> each of your web app users and they submit a username and password using
> your login form in the web app and the web app uses that information to
> access the database - isn't that 'authenticating' the user? So, I guess
> what I would like to know is - is it better to have the web app users be pg
> users too or is it a better idea to separate the two?

True enough. However, you still have to have a function at the application
level that checks to see if the database authenticated the user, so your
application STILL has to participate in the authentication. My point was
only that the database server cannot "talk" directly to the browser.

Unless you NEED the database users to be different, I wouldn't do this.

> The way that I was thinking of doing this is to have one pg user account
> that the web app uses to access the database, then set up a 'users' table to
> hold all of the web app user account info.

This is what I would do for most applications, but that is only my opinion.

Sean