<div dir="auto">trap for new players connecting arcgis to postgres. both table names, fieldnames and user names need to be lowercase. <div dir="auto">also you can't edit postgres tables in arc. </div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Fri, 14 Aug 2026, 17:44 Greg Troxel via QGIS-User, <<a href="mailto:qgis-user@lists.osgeo.org">qgis-user@lists.osgeo.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Namik SCHERZL - SLA via QGIS-User <<a href="mailto:qgis-user@lists.osgeo.org" target="_blank" rel="noreferrer">qgis-user@lists.osgeo.org</a>> writes:<br>
<br>
> In my structure we are currently migrate our GIS architecture from<br>
> ESRI to Qgis & Postgres. We would like to know the most recommended<br>
> method for authenticating PG via Qgis knowing that :<br>
<br>
Stepping back, the issue here is that your requirements are not at all<br>
defined. I've reordered your message.<br>
<br>
> * Securing the data flow.<br>
<br>
"Securing the data flow" doesn't really say anything. My own view is<br>
that there is little justification for transmitting (nonpublic) data<br>
across computers, unless protected by ssh, TLS, or similar. CPUs are<br>
fast, and the cost of encryption/decryption and authentication is surely<br>
small compared to the processing of that data. If you see it<br>
differently, please run tests and post a description of them and<br>
results.<br>
<br>
In particular, if you are controlling access to a resource with a<br>
password, I do not see it has responsible to transmit that password in<br>
cleartext connections even on your LAN that you think is ok, but surely<br>
is not reliably ok, in that proving that no device is compromised<br>
(including thermostats) is nearly impossible. Thus, I advise you to<br>
forget the concept of non-TLS cross-machine database access.<br>
<br>
> * We want to avoid transmitting login / password information between<br>
> users of the same project.<br>
<br>
I can't understand this.<br>
<br>
I think you are blurring granting database access to particular people,<br>
and granting database access to QGIS projects. Standard security<br>
practice is concerned about people (or some machine notion of principal,<br>
also), and QGIS projects are data files. You further should be<br>
controlling access to the QGIS project in its own right, and embedding<br>
credentials in projects and then relying on project control sounds<br>
unreasonably risky.<br>
<br>
Once you decide to control access by people, you can either create a<br>
database account for each authorized user and assign them separate<br>
passwords, or you can create a group account with one username/password<br>
and give that to all the authorized people. I think you said that you<br>
don't want shared credentials.<br>
<br>
If you have obligations to anyone else about the data -- non-disclosure<br>
agreements, information subject to GDPR, a requirement that data only be<br>
modified by authorized persons, etc., then I don't see shared<br>
credentials as responsible. (Yes, I know doing it right is harder; that<br>
doesn't change the analysis of what is ok.)<br>
<br>
> * we are keeping a few Arcgis licences, and they should have access to the DB<br>
<br>
The licenses, or people who are using Arggis? Surely arcgis can access<br>
postgis and the user can have a username/password.<br>
<br>
> I've seen that Qgis can store PG login and password in it's own local<br>
> storage and in the case we define a common authcfg ID for all our<br>
> users it's possible for several users to share the same project<br>
> without transferring any information/ rights.<br>
<br>
I'm having trouble following. If you mean that qgis can separate the<br>
config of "where is the datbase" keeping that in the project, while<br>
using other means (OS credentials storage) to store "for this databsae,<br>
use this username and that password", that makes sense.<br>
<br>
But the first thing to be clear on is whether you are using individual<br>
username/password, and if you have a security or integrity requirement<br>
to avoid group credentials.<br>
_______________________________________________<br>
QGIS-User mailing list<br>
<a href="mailto:QGIS-User@lists.osgeo.org" target="_blank" rel="noreferrer">QGIS-User@lists.osgeo.org</a><br>
List info: <a href="https://lists.osgeo.org/mailman/listinfo/qgis-user" rel="noreferrer noreferrer" target="_blank">https://lists.osgeo.org/mailman/listinfo/qgis-user</a><br>
Unsubscribe: <a href="https://lists.osgeo.org/mailman/listinfo/qgis-user" rel="noreferrer noreferrer" target="_blank">https://lists.osgeo.org/mailman/listinfo/qgis-user</a><br>
</blockquote></div>