ABAC or RBAC
June 16th, 2017
With the arrival of ABAC, companies are considering the switch from RBAC. Is this the right call or can RBAC still be relied on as a security solution?
There was a discussion on our company Slack recently about databases and XML, and someone pointed out that PostgreSQL has some nice XML functions. I’m a Postgres fan and knew that it had some XML functions but haven’t dug into them yet. Using my stormy-data project, I decided to play around with the data in there. Directions are included on how to get Postgres and populate the data via Flyway.
I started with something basic – just give me the states and the comments:
select xmlforest(state_id,comments)
from storm_info
Each row is returned like: <state_id>187</state_id><comments>Mainly D2 drought conditions persisted through January and into February. D3 drought conditions were present across portions of Henry and eastern Dale counties.</comments>
That’s nice, but we really don’t want the state_id
… the state name makes more sense. And let’s make sure it has a good tag name
select xmlforest(state.name as state,comments)
from storm_info
join state on state.id=storm_info.state_id
The result is:
<state>ALABAMA</state><comments>Mainly D2 drought conditions persisted through January and into February. D3 drought conditions were present across portions of Henry and eastern Dale counties.</comments>
But each row is just an XML Snippet – it’s not even well-formed since it doesn’t have a root tag. So let’s put all the results in one document. Doing that is actually pretty easy with the query_to_xml
function:
select query_to_xml('select state.name as state,comments
from storm_info
join state on state.id=storm_info.state_id',true,false,'')
There are some strange arguments for this function. To break it down:
xmlforest
but what the really means is to put each row in different documents or all in one, We want it all in one so we say to turn off xmlforest
.The result looks like:
`
It’s not pretty – I don’t like the table
tag as the root or row
for each row in the data. But it’s in a document…. you can run a simple XSLT to change those values if needed.
Mike has almost 20 years of experience in technology. He started in networking and Unix administration, and grew into technical support and QA testing. But he has always done some development on the side and decided a few years ago to pursue it full-time. His history of working with users gives Mike a unique perspective on writing software.