Content-Type: multipart/alternative;
 boundary="------------4YJOdtWuutKJKw1lKBjmr10Z"
Message-ID: <985846a7-97e6-4c43-a34a-5541faf2c37c@dbi-services.com>
Date: Wed, 18 Oct 2023 09:56:25 +0200
User-Agent: Mozilla Thunderbird
Subject: Re: docs: set role permission checking, do I read this wrong?
Content-Language: en-US
To: "David G. Johnston" <david.g.johnston@gmail.com>
Cc: "pgsql-docs@lists.postgresql.org" <pgsql-docs@lists.postgresql.org>
References: <93e0bf53-41ae-4718-a1c5-cec36283bbc7@dbi-services.com>
 <CAKFQuwY9pa475guw29sppEM3FqcmPRXFeLqCAx1dX2vrzsg7Fg@mail.gmail.com>
From: Daniel Westermann <daniel.westermann@dbi-services.com>
In-Reply-To: 
 <CAKFQuwY9pa475guw29sppEM3FqcmPRXFeLqCAx1dX2vrzsg7Fg@mail.gmail.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?b2NBWHVYelZDdGFCRHRob3Y1RHhSck9zbzZaNng4MG55eFc2RnhSc3FDWFRq?=
 =?utf-8?B?cW1UOFA2K2hTVGUzN3J3UjZGNVNNN2RGWVJ4WEhtQXZ3bHE5SXV0VFVZcERM?=
 =?utf-8?B?S3dJcUV2bTdvS3c3cmNtR2IzdkVEdmVWVFRlTWU3NHQwZTRhM2pUMmFIL3B2?=
 =?utf-8?B?dzAwdXMwSy9MbTRkMmxGM0VEN0E2a1VKMnMveEx5VUJnemhkMnJiM0U3WXp0?=
 =?utf-8?B?R0JOQm9XR1Jzd21kZUx4NEZRT01STWxnSmF6VnJpK3V1amFFaXZDYk5ubUVP?=
 =?utf-8?B?cGhmUWRIZksyUERGNjJ2OHZBOUtrbnEraTVkMEt5Rm9EZHNYbWg4NHozRGly?=
 =?utf-8?B?M1phTWNoL3N5c01OV29rdzRLMFY2MzFlWmNNOGEyZk1hdmdlV3dKdFdKSTg4?=
 =?utf-8?B?bkZxRTlLOUJpZmd0VWZ1S1BubldIbEZBdkI4LzVoOWpHbWlUckgvSUZjZ3BG?=
 =?utf-8?B?anFUWWlRamZFSnZ3Zjd4Sk9ZclFGNmJEYVQ5TXE3QmVLRitIdHpwN081V28r?=
 =?utf-8?B?NkY4QmlFaFpLQ056Rk1aWXJmSkU0SWxDMEN1bjZQSDVuaC9YWnVoTWxaZUFO?=
 =?utf-8?B?L2ZEVDM2VUsxK2JENGFtZkxDNFNzQVBMQVRxK3Rvb0lZVnVDSXlsc2pvNU1Y?=
 =?utf-8?B?aWhKR3BDTitkcGlmdjE4bzh6QWRqZ3NyeVJxbEd2emNMNXpnQS9NS0x1ZjJR?=
 =?utf-8?B?R3pTSDh2bXBBb2U3WEhGelNrVjVUQ21DNzlhMDBEWFd5QzNPREErNUNpWG42?=
 =?utf-8?B?SitlU1k5SWVjY3IyRldQZDFTeVIzajEvSnppeTBzbXQzTjdSeitUQmRpOEJ0?=
 =?utf-8?B?cStwY3pXYnZGY3ZOa3gxakFDUTdwMFcvSXQ0enNJaUxDRlNWQitzV0d2TG9n?=
 =?utf-8?B?VmJrK2JYZmpyU2dZQVlzQmdYdHFDVDY5U25uVHNqWTVTUVRnM1l2YnJWVlhK?=
 =?utf-8?B?aVJQSzVDNmplWTVHaXNCclBlWXM4ZWxYTE00OTI1WnhnbUMvdE5jNG04SllM?=
 =?utf-8?B?ZEU1VmtPU2NXVkJDTnhXMzNOYjNqZGw1SDVhdHVweFhmNHg3dlM3d2FRTFVY?=
 =?utf-8?B?a2tTOWNWZlhKeWpjZnJjOU5aNXYvRlQ4ekNsaWhTZHk2REZMMkxGQzhRa0tF?=
 =?utf-8?B?aE1FT1lJN0xNL2tSN0VsS2g3S2RFTWNZZTN6Q2F5SzU3SFNpMUFIZFlESVg4?=
 =?utf-8?B?eEU3QUFsQlpST0JFcVlEbDRIQWNIWnhiWldFdHQzcVBPemxMb3lQYmZoeHBT?=
 =?utf-8?B?UW1tYmFIQ3BxWFVhSEJlZHkrZVpsK04wOVRGa1BRWTBGNHZjb2dYNXRhTGdm?=
 =?utf-8?B?N0xCUG9FTnV4RlZBUlNCUUFrSThFZEVSWlNOZGRhZFVjaW9jSCtsZlFEWXhL?=
 =?utf-8?B?SVdCRzVwZkltbnlVWUFpUVRKTlZtbS80M3grYld2YWJ0YkMzVENXV012aDNp?=
 =?utf-8?B?MWxSWlVvVGdubVhGOG1PdUU3aDV0R01mSkcwM24zUTBYVjVQK0Q3MW5TKzU2?=
 =?utf-8?B?S01JZkRQR1RwdW0wSGFsRVBGU2dlOVlPYUhTY1dhbFVBV25qWGRjSms1WWZk?=
 =?utf-8?B?ZXQ2d2lFQTBYZTMyTUdPVTlpZ2ZGeTVHaGQ1anllSDlZQnFRSmNvUGlNZTlo?=
 =?utf-8?B?TVZaRDJMRUtoWkNoOUNOZDlTTTl0YmI0cTFxdDVXZ1htNVlVTHgrUHNSUGw5?=
 =?utf-8?B?bzcyYlZSdmRkcXpRcFFlMlh5ZXk0d3E2YUJXUGNZQ1FkbWtIblA5V0F2clZT?=
 =?utf-8?B?ZHNpNmgvT2tjTGZORjNpbXZTSW5RMGtkNEEwMWlZdS9GLzEyRUxUTlNSQ2FJ?=
 =?utf-8?B?L3ZMMXlmKzk2Wlo0R1AvSzh6dnRQbmZzYm5LdVhjeUVYNENnSThuOUp1MHZs?=
 =?utf-8?B?aEZFYXBteG0zVE5Fa3E0U2hkY3BZY0JxakZCWEFwT2wzeXFEN3ZmcUZYeTEz?=
 =?utf-8?B?Q1BFVE5mcGpyV1k3TytxcWdIb1RVaHhXMXBkOW1qVkdGVE03WXhiSUZnWE5q?=
 =?utf-8?B?bURvRGV1NWRUUExyMWFvUnlZZ1RRS2lqL3NHV3JhVm9UWTRSOFkyM3c0RFBW?=
 =?utf-8?B?Z3c1ell3a0dTOUVMMmxrczVhck1SUHdhbEp4clNScWM3RGw4WXRUaExYTDVu?=
 =?utf-8?B?anJqK2NLUmVxdFF1Z0lDeWp1R3ppVHhOd2UxWnBKTThpbWIycTl3d0VSNDg0?=
 =?utf-8?B?YlUwSlkwajIyQ2x0QTQ0MGpOOWVwUVhGYWpKRVRwZGowcTlIcWpXcXhhak0x?=
 =?utf-8?Q?ugllCxvEnRiYLPPi2VoylPOQiL+abYv6wLP7VDIano=3D?=
X-OriginatorOrg: dbi-services.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 74aa8bde-6d73-44a3-0d59-08dbcfafbb1e
X-MS-Exchange-CrossTenant-AuthSource: GV0P278MB0419.CHEP278.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Oct 2023 07:56:26.9872
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: b9c70613-b1ea-47b7-9fdd-e6f3a67ce75c
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 
 SdPcdCQ9UrXrJt9+dxSmdAWUyGjStyOLLdPEkI+0a3CzIIosyYaZxbmIMb9RDdGv7nJp2yPlEfiW2117UAMHM2s97RIJi+7Oac9SQeBQvxlj6pkwhIeGlia85NZ2Tnur
X-MS-Exchange-Transport-CrossTenantHeadersStamped: ZR1P278MB1101
List-Id: <pgsql-docs.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-docs@lists.postgresql.org>
List-Owner: <mailto:pgsql-docs-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-docs>
Archived-At: 
 <https://www.postgresql.org/message-id/985846a7-97e6-4c43-a34a-5541faf2c37c%40dbi-services.com>
Precedence: bulk

--------------4YJOdtWuutKJKw1lKBjmr10Z
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 10/18/23 09:26, David G. Johnston wrote:
> On Wednesday, October 18, 2023, Daniel Westermann 
> <daniel.westermann@dbi-services.com> wrote:
>
>
>     "After |SET ROLE|, permissions checking for SQL commands is
>     carried out as though the named role were the one that had logged
>     in originally."
>
>     Isn't it the other way around and permission checking is done as
>     "a", or do I read this wrong?
>
>
> It is saying “a” is the current_user:
>
> When you set role to (named role) a the system behaves as if (named 
> role) a had logged in originally (even though, in that example, 
> postgres is the role that originally logged in)
>
> David J.
>
Thank you, this is what I see in the small example. Maybe it is my 
English, but this sentence sounds confusing.

Regards
Daniel
--------------4YJOdtWuutKJKw1lKBjmr10Z
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  </head>
  <body>
    On 10/18/23 09:26, David G. Johnston wrote:<br>
    <blockquote type="cite" cite="mid:CAKFQuwY9pa475guw29sppEM3FqcmPRXFeLqCAx1dX2vrzsg7Fg@mail.gmail.com">
      
      On Wednesday, October 18, 2023, Daniel Westermann &lt;<a href="mailto:daniel.westermann@dbi-services.com" moz-do-not-send="true" class="moz-txt-link-freetext">daniel.westermann@dbi-services.com</a>&gt;
      wrote:<br>
      <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
        &quot;After |SET ROLE|, permissions checking for SQL commands is
        carried out as though the named role were the one that had
        logged in originally.&quot;<br>
        <br>
        Isn't it the other way around and permission checking is done as
        &quot;a&quot;, or do I read this wrong?<br>
      </blockquote>
      <div><br>
      </div>
      <div>It is saying “a” is the current_user:</div>
      <div><br>
      </div>
      <div>When you set role to (named role) a the system behaves as if
        (named role) a had logged in originally (even though, in that
        example, postgres is the role that originally logged in)</div>
      <div><br>
      </div>
      <div>David J.</div>
      <div><br>
      </div>
    </blockquote>
    Thank you, this is what I see in the small example. Maybe it is my
    English, but this sentence sounds confusing.<br>
    <br>
    Regards<br>
    Daniel<br>
  </body>
</html>

--------------4YJOdtWuutKJKw1lKBjmr10Z--