1

I have a PostGIS database that includes multiple schemas, tables and a QGIS project. I have 3 general user roles: admin, editor and reader. I know of the issue with database connection information being saved within QGIS projects and how they can cause 'higher' privileges being given to users with 'lower' levels of access (e.g. reader).

The idea is, that the editor has read access to all database layers and read and edit privileges on QGIS projects. The reader should only have read access on everything. The editor will create virtual fields within the database tables and would like to share these with the reader.

How do I make sure, the editor doesn't accidently save his or her credentials in the QGIS project and then unvoluntarily gives out editing privileges to the reader?

Version info: QGIS 3.34 LTR, PostgreSQL 15.5, PostGIS 3.4

Improve this question

1 Answer 1

Reset to default
1

One option is to never use nor save the credentials in QGIS, but instead to use a service file, as described in this post.

Improve this answer
1
  • The problem with this solution is the need to create a service file on every computer (which needs the IT-admin credentials every time) accessing the database right? Also, that doesn't make sure the QGIS editor doesn't save his credentials in the project and therefore gives the reader extra privileges.
    – geo_theo
    Commented Apr 23 at 22:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.