From: Tom Lane <tgl@sss.pgh.pa.us>
To: =?utf-8?Q?=C3=81lvaro?= Herrera <alvherre@kurilemu.de>
cc: Laurenz Albe <laurenz.albe@cybertec.at>,
        Calvin Guo <newoakllc2023@gmail.com>,
        pgsql-general@lists.postgresql.org
Subject: Re: set role command
In-reply-to: <202511241648.tw7dx3ga7rxk@alvherre.pgsql>
References: <202511241648.tw7dx3ga7rxk@alvherre.pgsql>
Comments: In-reply-to =?utf-8?Q?=C3=81lvaro?= Herrera <alvherre@kurilemu.de>
	message dated "Mon, 24 Nov 2025 18:05:50 +0100"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <981854.1764009811.1@sss.pgh.pa.us>
Date: Mon, 24 Nov 2025 13:43:31 -0500
Message-ID: <981855.1764009811@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/981855.1764009811%40sss.pgh.pa.us>
Precedence: bulk

=?utf-8?Q?=C3=81lvaro?= Herrera <alvherre@kurilemu.de> writes:
> For what it's worth, I think we break the SQL standard's security model
> by providing RESET ROLE and RESET SESSION AUTHORIZATION, neither of
> which the standard has.

I don't think so.  They are just shorthand for issuing a SET to the
original value, so how do they break the model in a way that that
doesn't?

> This means that in the standard model you have
> commands to lower your privilege, but once you've lowered them, you
> cannot return (in the same connection) to what you had.

The reason PG acts as it does is that we interpret "the permissions
required to do SET SESSION AUTHORIZATION" as "did your originally
authenticated ID have permission to do that SET?".  Since those
permissions are implementation-defined, I don't think it's possible
to argue that our choice breaks standards compliance.  You can argue
that it's a bad idea, but it's a bit late to change it now.

In practical terms, the one-way changes that Calvin wants are just not
that attractive.  What people have actually asked for, particularly
connection-pooler authors, are a way to switch session authorization
in such a way that you can only go back with some additional secret
sauce, like a one-time password generated at the pooler level.
That'd allow sharing the same connection across different user IDs,
which isn't safe today.

			regards, tom lane