Re: Column level security question

Hi Tom,
The column or columns can just return null for the non-authorized user then there is not SQL semantics issue.

Garry

-----Original Message-----
From: Tom Lane [mailto:tgl(at)sss(dot)pgh(dot)pa(dot)us]
Sent: Wednesday, June 21, 2017 12:27 PM
To: Garry Chen <gc92(at)cornell(dot)edu>
Cc: pgsql-novice(at)postgresql(dot)org
Subject: Re: [NOVICE] Column level security question

Garry Chen <gc92(at)cornell(dot)edu> writes:
> For example: a function that only allow deptno=30 or resp=10 to see column named 'sale' and 'card_num' and a policy that applied to the table that can carry out the function. So only user in deptno 30 or responsibility level equal to 10 can see column named 'sale' and 'card_num' without using role. Such that the security can be relied on the data owner not the DBA.

I think you'd be better off to think of a way to express this through grantable privileges, perhaps with some intermediate views that different user populations are allowed to access. It's really hard to think of a way that columns could be dynamically allowed or not allowed without breaking SQL semantics pretty thoroughly.

regards, tom lane