DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.uk;
	h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding;
	b=RxPnHT+vwn8RSjndnWBlFhhmxwgUhhTyjQznnJWxVbSueLded8TWAIdDTSxwkxepNE0/hC5yh09GDhNCHYHKIhjmr8yWKQu96xKFMmq6Y0eWPB2o8gHh/80xNZHsiZTRLmd8xpj0fLJDAI4WbTRe25NLe594D24HvrOal5WK5Ew=;
References: <1311784043.24356.YahooMailNeo@web26002.mail.ukl.yahoo.com>
	<10638.1311784321@sss.pgh.pa.us>
	<1311784785.5983.YahooMailNeo@web26004.mail.ukl.yahoo.com>
	<4E2FFB6E020000250003F81B@gw.wicourts.gov>
Message-ID: <1311798149.1639.YahooMailNeo@web26004.mail.ukl.yahoo.com>
Date: Wed, 27 Jul 2011 21:22:29 +0100 (BST)
From: Glyn Astill <glynastill@yahoo.co.uk>
Reply-To: Glyn Astill <glynastill@yahoo.co.uk>
Subject: Re: Adding line to pg_hba.conf for a specific group makes superuser
	authentication fail in 9.0?
To: Kevin Grittner <Kevin.Grittner@wicourts.gov>, Tom Lane <tgl@sss.pgh.pa.us>
Cc: "pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
In-Reply-To: <4E2FFB6E020000250003F81B@gw.wicourts.gov>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

> From: Kevin Grittner <Kevin.Grittner@wicourts.gov>=0A=0A>Glyn Astill <gly=
nastill@yahoo.co.uk> wrote:=0A> =0A>>=A0=A0How can I specifically catch sup=
erusers?=0A> =0A> Create a group (nobody?) that you don't grant to any user=
s.=A0 Only=0A> superusers will be a member of it.=0A> =0A=0AAh of course, s=
imple, thanks Kevin.=0A=0AI can't help but feel that there should be someth=
ing in the docs for 9.0 to specify this, since it is a behaviour difference=
 from 8.4 and earlier.=0A=0AThe docs (http://www.postgresql.org/docs/9.0/in=
teractive/auth-pg-hba-conf.html) do say:=0A=0A"Recall that there is no real=
 distinction between users and groups=A0=A0=A0=A0=A0=A0=A0=A0in PostgreSQL;=
 a + mark really means "match any of the roles that are directly or indirec=
tly members=A0=A0=A0=A0=A0=A0=A0=A0of this role", while a name without a + =
mark matches=A0=A0=A0=A0=A0=A0=A0=A0only that specific role" =0A=0AMaybe th=
e docs should be embellished to also say "since a superuser is automaticall=
y considered a member of any group, it should be taken into account that na=
mes with a + mark will affect all superusers (although this was not the cas=
e prior to 9.0)" or something along those lines.=0A=0AGlyn=A0 =0A