Using Postgres RLS with Ignition

Ignition
, ,
1

Hi everyone,
I would like to try using RLS provided by Postgres.

To do so, i need to understand if there is any documentation—please kindly point it out—and how the lifecycle of a database connection works.

In the section dedicated to database connections, within the
connection initialization
there is the section
connection initialization commands
with the comment:
a set of commands (one per line) that will be executed each time a connection is pulled from the pool. can be used to reset environment variables.

I am interested in understanding how and when a connection is requested/managed by the gateway, whether this connection is shared among all resources using it or if its lifecycle is limited to a single project or session.

Since what i would like to implement is a multi tenant management system using rls and not relying solely on query control,
is there a way to dynamically pass parameters during the initialization of a database connection and ensure that this session is valid only for a single vision/perspecive session, or even better, that a single connection is requested per query?

Thanks in advance.

2

This. A database connection pool is a global resource. Any query operation against a DB connection uses any idle connection in the pool. A subsequent query, even on the same thread, may use a different pool connection. The only exception is when using transaction IDs in scripted queries.

While Ignition's TOS now allows it, the architecture fundamentally lacks the security controls to allow different tenants to use any designer. If you are allowing any tenant to use a designer, then they have the tools to access any other tenants' data and projects.

Not at all.

1 Like