Date: Fri, 8 May 2020 01:02:11 -0400
From: Alvaro Herrera <alvherre@2ndquadrant.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Stephen Frost <sfrost@snowman.net>, chris+postgresql@qwirx.com,
	pgsql-docs@lists.postgresql.org, pgsql-hackers@lists.postgresql.org,
	Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Subject: Re: Logical replication subscription owner
Message-ID: <20200508050211.GA6945@alvherre.pgsql>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <17709.1588908623@sss.pgh.pa.us>
User-Agent: Mutt/1.10.1 (2018-07-13)
Precedence: bulk

On 2020-May-07, Tom Lane wrote:

> FWIW, I would argue that LOGIN permits logging in on a regular SQL
> connection, while REPLICATION should permit logging in on a
> replication connection, and there's no reason for either to depend on
> or require the other.

I agree with this.

> >> Also- what about per-database connections?  Does having REPLICATION mean
> >> you get to override the CONNECT privileges on a database, if you're
> >> connecting for the purposes of doing logical replication?
> 
> No, why would it?  Should LOGIN privilege mean you can override
> CONNECT?  That's nonsense.  You need the respective privilege
> to connect with the protocol you want to connect with, and you
> also need CONNECT on the DB you want to connect to.

And this.

-- 
Álvaro Herrera                https://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services