From: Natalie Wenz <nataliewenz@ebureau.com>
To: pgsql-admin@postgresql.org <pgsql-admin@postgresql.org>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Subject: Re: postgres_fdw user mapping and role inheritance
Date: Fri, 17 Jul 2015 12:51:37 -0500
Message-ID: <457CD1FA-008B-4E6D-8E80-FB7DBB35E215@ebureau.com> (raw)
In-Reply-To: <7673.1437077526@sss.pgh.pa.us>
References: <2EBBB4BA-B1C9-4978-8182-F35F8831FD0E@ebureau.com>
<4969.1437070567@sss.pgh.pa.us>
<32B4D87F-0466-467A-9F2B-00F696E9E056@ebureau.com>
<7673.1437077526@sss.pgh.pa.us>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
Oh! Of course! The local database doesn't know anything about the role privileges on the remote database, so the information isn't even available on the local database to somehow take the union of all the privileges of foo and bar because they are defined on the remote database. Thanks for responding. I got so wrapped up in our simple use case (where any individual_user in the local_group would connect to foreign_server as the same foreign_user) and couldn't come up with a counter example.
For our use case, can you think of any other way to do it besides creating a user mapping for every member of local_group? Gilberto's suggestion of setting the session authorization (I think?) won't work because the individual_users don't have privileges to set that. ("ERROR: permission denied to set session authorization")
Thanks again for your responses; I appreciate the help!
Natalie
> On Jul 16, 2015, at 3:12 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>
> Natalie Wenz <nataliewenz@ebureau.com> writes:
>> Would it be necessary to disambiguate?
>
> Of course. If the mapping for group_x says to connect to the remote
> server as user foo, while the mapping for group_y says to connect
> as user bar, then it matters which one we use. But there would be no
> principled way to choose, if the current userid is a member of both
> group_x and group_y.
>
> regards, tom lane
>
>
> --
> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-admin
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: nataliewenz@ebureau.com, tgl@sss.pgh.pa.us
Subject: Re: postgres_fdw user mapping and role inheritance
In-Reply-To: <457CD1FA-008B-4E6D-8E80-FB7DBB35E215@ebureau.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox