From: Tom Lane <tgl@sss.pgh.pa.us>
To: Alvaro Herrera <alvherre@2ndquadrant.com>
cc: Stephen Frost <sfrost@snowman.net>, chris+postgresql@qwirx.com,
        pgsql-docs@lists.postgresql.org, pgsql-hackers@lists.postgresql.org,
        Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Subject: Re: Logical replication subscription owner
In-reply-to: <20200508014734.GA3552@alvherre.pgsql>
References: <20200508014734.GA3552@alvherre.pgsql>
Comments: In-reply-to Alvaro Herrera <alvherre@2ndquadrant.com>
	message dated "Thu, 07 May 2020 21:47:34 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <17708.1588908623.1@sss.pgh.pa.us>
Date: Thu, 07 May 2020 23:30:23 -0400
Message-ID: <17709.1588908623@sss.pgh.pa.us>
Precedence: bulk

Alvaro Herrera <alvherre@2ndquadrant.com> writes:
> I'd welcome input from other people on this issue; only now I noticed
> that it's buried in pgsql-docs, so CCing pgsql-hackers now.

FWIW, I would argue that LOGIN permits logging in on a regular SQL
connection, while REPLICATION should permit logging in on a
replication connection, and there's no reason for either to depend on
or require the other.

> On 2020-Apr-23, Stephen Frost wrote:
>> Also- what about per-database connections?  Does having REPLICATION mean
>> you get to override the CONNECT privileges on a database, if you're
>> connecting for the purposes of doing logical replication?

No, why would it?  Should LOGIN privilege mean you can override
CONNECT?  That's nonsense.  You need the respective privilege
to connect with the protocol you want to connect with, and you
also need CONNECT on the DB you want to connect to.

			regards, tom lane