How to hide metadata from Postgres users?

Question

I need to provide views-only access to some subset of a database, for use by report-writing tools. It's easy enough to use permissions to prevent access to the data in the underlying tables, but I need to go one step further, and prevent these views-only users from examining the contents of Postgres' metadata tables, which would allow them to reverse-engineer the entire database schema. I managed to do that, too.

Here's my problem: When I connect Crystal Reports to this database, it emits a series of error messages, probably due to its inability to nose around in the database's metadata.

I'd really like to allow Crystal Reports to see only that subset of the metadata which describes the views that Crystal Reports can actually query (or at least get it, and other tools like it, to stop complaining). Is there some "right" way to do this that I'm missing?

Answer 1

Doing that is not supported. You can try a little bit, and you will succeed a little bit, but everything else around you will fail. Don't do it, it won't work.

If you need to protection your intellectual property from your clients, create a proper contract or license agreement.

Answer 2

One approach I have seen some ERP vendors take to this is obfuscation, for example if you have a normal table called MYTABLE and in your application the SQL SELECT MYCOLUMN FROM MYTABLE, then as part of the build process all the DDL and source code would be substituted so you would end up with hard-to-read nonsense such as SELECT A FROM B (yet the developers would still have a readable version). Right now in fact I am dealing with a third-party application that literally has things like SELECT BHHRLT0 FROM TFAZCPP and so on. Needless to say they wasted their time on this rather than optimization... sigh

Peter is right; there is no supported way to do this - with the caveat that if you really, really must, then the obvious solution is a completely separate reporting database replicated from the original.