Forum OpenACS Q&A: Re: Session Management

Collapse
4: Re: Session Management (response to 1)
Posted by Code Warrior on 08/30/04 08:27 PM
Why not create database accounts for each user and let the database handle access to information using group permissions?  Is this a viable solution?  Is it more/less work than just putting access information to fields in a table?  Which method is more secure?  Thanks.
Collapse
5: Re: Session Management (response to 4)
Posted by Andrew Piskorski on 08/31/04 02:26 AM
Um, because that's crazy?

First, "session management" on a web site has nearly nothing whatsoever to do with database accounts in Oracle, they're largely orthogonal concepts.

Second, say you wanted to give every single registered user his own Oracle account. openacs.org currently has 7,897 registered users. Some sites using OpenACS have 50,000+ registered users. I really, really doubt that Oracle accounts are designed for that. It probably wouldn't work, and even if it did, AFAICT there's no advantage whatsoever to doing it.

Oracle programmers sometimes talk about an Oracle "schema" when they mean an Oracle "user", because there is usually a one to one correspondance between the two. So if in doubt, substitute the word "schema" anywhere you see Oracle "user" or "account" and think about it that way. Does every individual user of a website need to define separate relational tables in his own database schema? No, of course not.

And while Oracle does have database accounts, I think PostgreSQL has no such thing, anyway.

David, I suggest you take a step back, and tell us about what problem you're actually trying to solve or understand, why you think "session management" is related to it, etc.