Date: Sat, 9 May 2020 14:09:33 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Michael Paquier <michael@paquier.xyz>,
	Kyotaro Horiguchi <horikyota.ntt@gmail.com>,
	alvherre@2ndquadrant.com, chris+postgresql@qwirx.com,
	pgsql-docs@lists.postgresql.org, pgsql-hackers@lists.postgresql.org,
	peter.eisentraut@2ndquadrant.com
Subject: Re: Logical replication subscription owner
Message-ID: <20200509180933.GN13712@tamriel.snowman.net>
References: <17709.1588908623@sss.pgh.pa.us>
 <20200508050211.GA6945@alvherre.pgsql>
 <20200508.150326.909507514141434296.horikyota.ntt@gmail.com>
 <20200509085701.GM11539@paquier.xyz>
 <3747.1589037446@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="j+blFMWKY/m72zgp"
Content-Disposition: inline
In-Reply-To: <3747.1589037446@sss.pgh.pa.us>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--j+blFMWKY/m72zgp
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Michael Paquier <michael@paquier.xyz> writes:
> > Not to make the life of everybody more complicated here, but I don't
> > agree.  LOGIN and REPLICATION are in my opinion completely orthogonal
> > and it sounds more natural IMO that a REPLICATION user should be able
> > to log into the server only if it has LOGIN defined.
>=20
> ISTM those statements are contradictory.  The two privileges could
> only be called orthogonal if it's possible to make use of one without
> having the other.  As things stand, REPLICATION without LOGIN is an
> entirely useless setting.

Allowing a login to the system by a role that doesn't have the LOGIN
privilege isn't sensible though.

Perhaps a middle ground would be to set LOGIN on a role when REPLICATION
is set on it, if it's not already set (maybe with a NOTICE or WARNING or
such saying "also enabling LOGIN for role X", or maybe not if people
really think it should be obvious).

I don't think taking away login should take away replication though as
maybe there's some reason why someone would want that, nor should we
take away login if replication is taken away, this would strictly just
be a change for when REPLICATION is added to a role that doesn't have
LOGIN already.

Thanks,

Stephen

--j+blFMWKY/m72zgp
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJetvHdAAoJEO1sijiDR2RVC9gP/3O9oMx4nDNStOf1U5dFevg3
C94yqXJ0E+jc9FqaJ8TIdKeaJBr8Ld83raLWNBRL2TFRJeSqo3mQWp+X8QRHghIz
ANZCkLPc4rMO0qK7U62Q2fyKNSNq4wuAu+9iCiOEitDBmiM1TaPsYDIdO7FtOVri
nCh7sdKvg36R/3wIQEgIxYPNJCOnflCQr1jbVTYfZAKZQKBvi8KMh0xib9a4nMfZ
y5JdGe046TFLVnnFSWYw/x/zAgzr31pLj0vxJDPYEzZ66IYDYW1BRu7chBXBpIov
GAOgnOQH8xv00EZ+caWaXbJ+ASeW4xWk304yJlVFlmiig1tM50n62DuidKxNuW6F
J0kjqIjPqgxr42DuxgrHg4vAgRgeEmfRCfugeVJNh+1Da7VECMYO3L4IVqOhfdxO
Lg6PpdtmbYlleyJiciMYDnTZElkUeRhITh5M+nHLyAvWfaPFyKfbwSV5vu3wGd5F
ewpVxAv5KZ2i1EXHxPuHk2Wjzg4Ygd8o7ylhncmgW38zwO+m0o+HsIY5Bkg5dwuB
Y6kW/Y8qGbf9+mEfj5IQjqOfidOv7Fu4srvRFBshhttIlMBCf3b+Ubyy3/d31tHn
4mEY30Mmz2HcNsX8u3BLG4ubyUvbzcTGS3Fg2FOZDrGveIm9MlX6YNjaWbPxK+Gd
LB97Ut9KlEPI0eraPrNd
=4SG/
-----END PGP SIGNATURE-----

--j+blFMWKY/m72zgp--