Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2102\))
Subject: Re: postgres_fdw user mapping and role inheritance
From: Natalie Wenz <nataliewenz@ebureau.com>
In-Reply-To: <7673.1437077526@sss.pgh.pa.us>
Date: Fri, 17 Jul 2015 12:51:37 -0500
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Message-Id: <457CD1FA-008B-4E6D-8E80-FB7DBB35E215@ebureau.com>
References: <2EBBB4BA-B1C9-4978-8182-F35F8831FD0E@ebureau.com>
 <4969.1437070567@sss.pgh.pa.us>
 <32B4D87F-0466-467A-9F2B-00F696E9E056@ebureau.com>
 <7673.1437077526@sss.pgh.pa.us>
To: "pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

Oh! Of course! The local database doesn't know anything about the role priv=
ileges on the remote database, so the information isn't even available on t=
he local database to somehow take the union of all the privileges of foo an=
d bar because they are defined on the remote database. Thanks for respondin=
g. I got so wrapped up in our simple use case (where any individual_user in=
 the local_group would connect to foreign_server as the same foreign_user) =
and couldn't come up with a counter example.=20

For our use case, can you think of any other way to do it besides creating =
a user mapping for every member of local_group? Gilberto's suggestion of se=
tting the session authorization (I think?) won't work because the individua=
l_users don't have privileges to set that. ("ERROR:  permission denied to s=
et session authorization")

Thanks again for your responses; I appreciate the help!

Natalie

> On Jul 16, 2015, at 3:12 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>=20
> Natalie Wenz <nataliewenz@ebureau.com> writes:
>> Would it be necessary to disambiguate?
>=20
> Of course.  If the mapping for group_x says to connect to the remote
> server as user foo, while the mapping for group_y says to connect
> as user bar, then it matters which one we use.  But there would be no
> principled way to choose, if the current userid is a member of both
> group_x and group_y.
>=20
> 			regards, tom lane
>=20
>=20
> --=20
> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-admin


--=20
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin