Date: Wed, 22 Apr 2020 13:46:11 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: chris+postgresql@qwirx.com, pgsql-docs@lists.postgresql.org
Subject: Re: Logical replication subscription owner
Message-ID: <20200422174611.GX13712@tamriel.snowman.net>
References: <158695933852.25700.8124720971187835491@wrigleys.postgresql.org>
 <20200422174029.GA17052@alvherre.pgsql>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="IScD99Zwf7jssOrn"
Content-Disposition: inline
In-Reply-To: <20200422174029.GA17052@alvherre.pgsql>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--IScD99Zwf7jssOrn
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Alvaro Herrera (alvherre@2ndquadrant.com) wrote:
> On 2020-Apr-15, PG Doc comments form wrote:
> > If the logical replication subscription is owned by a role that is not
> > allowed to login (for example, if the LOGIN privilege is removed after =
the
> > subscription is created) then the logical replication worker (which use=
s the
> > owner to connect to the database) will start to fail with this error
> > (repeated every 5 seconds), which is pretty much undocumented:
> >=20
> > FATAL:  role "XXX" is not permitted to log in
> > LOG:  background worker "logical replication worker" (PID X) exited with
> > exit code 1
> >=20
> > You might want to include that error message in the docs, to ensure tha=
t web
> > searches for it bring the user to this documentation.
>=20
> I wonder if a better answer is to allow the connection when the
> REPLICATION priv is granted, ignoring the LOGIN prov.

Erm, no, I wouldn't have thought that'd make sense- maybe someone
specifically wants to stop allowing that role to login and they remove
LOGIN?  That REPLICATION would override that would surely be surprising
and counter-intuitive..

Thanks,

Stephen

--IScD99Zwf7jssOrn
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJeoILjAAoJEO1sijiDR2RVqCUP/1vHCY0idhcNYKZEQS36RQaf
gaVpIkviBlla0OQP59QW7XhZzIF1IJYVLH7taM1EaJAfpyMwOcGXk7YkmTrT2HTn
rHOkL/dbOQKxHAQDn/S+Epy2mEyYzw6EY38N/qYPbYwksTVjQgo6ZdavwZmSx45L
XNlIZ/KJahYVMQTgU4O5iPf7k1+Z3ACp/A4goBmDgeKXi29rfNjdFsNnLFkq3BH7
YJeoyYJtoLCE1Tp382mu4xXFx6i4bgBf0cyfVDmlJbl7ZPR4sfrn0vFDSAOFF1kK
80rCFOqIhDmM/tQPdw60kK4rQealE5ZPRhyFKrhdjKREtJdZ5nUaI2uj7Pdxcgvd
tBnTKENSEc6fKYQ0LrvGalM1WNJYJdwEJ6kTpOPbZaEdZmA6X/9gPYTXcqOdUP9E
TLDUFGxzQE0fOFIQzUQysOv0PbteMEPLksDq0QIDsVXkyYc/0fiaD89/WuyJ440K
jNOetxfsVy1+KtjyQkFZqWACd7yQM4IXcHR8jGQ2krF8LK6DUuvsEIj9H1lv01OQ
rEpnRh2OTjJNki4OKLRZBvIAociFjvNeElrPUx/aiy5J6YFMpiuF0rdPmESMgNzP
rI42HVj6mkVViCTCmXc2R31uhQd7POfq0Z6hN5af5bx+WEuGhpyHCNz+3gtjlr2A
wFw1W/7wmxSdA0t9lTEX
=ofE7
-----END PGP SIGNATURE-----

--IScD99Zwf7jssOrn--