From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jacob Champion <pchampion@vmware.com>
cc: "sfrost@snowman.net" <sfrost@snowman.net>,
        "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Subject: Re: Proposal: Save user's original authenticated identity for logging
In-reply-to: <c65fd6360d9a174dcf98b1e2e7d02ca654e0ca85.camel@vmware.com>
References: <c55788dd1773c521c862e8e0dddb367df51222be.camel@vmware.com>
 <20210129220101.GE27507@tamriel.snowman.net>
 <2829030.1611959442@sss.pgh.pa.us>
 <c65fd6360d9a174dcf98b1e2e7d02ca654e0ca85.camel@vmware.com>
Comments: In-reply-to Jacob Champion <pchampion@vmware.com>
	message dated "Fri, 29 Jan 2021 23:33:02 +0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2832057.1611963634.1@sss.pgh.pa.us>
Date: Fri, 29 Jan 2021 18:40:34 -0500
Message-ID: <2832058.1611963634@sss.pgh.pa.us>
Precedence: bulk

Jacob Champion <pchampion@vmware.com> writes:
> On Fri, 2021-01-29 at 17:30 -0500, Tom Lane wrote:
>> What happens if ALTER USER RENAME is done while the session is still
>> alive?

> IMO the authenticated identity should be write-once. Especially since
> one of my goals is to have greater auditability into events as they've
> actually happened. So ALTER USER RENAME should have no effect.

> This also doesn't really affect third-party auth methods. If I'm bound
> as pchampion@EXAMPLE.COM and a superuser changes my username to tlane,
> you _definitely_ don't want to see my authenticated identity change to 
> tlane@EXAMPLE.COM. That's not who I am.

Ah.  So basically, this comes into play when you consider that some
outside-the-database entity is your "real" authenticated identity.
That seems reasonable when using Kerberos or the like, though it's
not real meaningful for traditional password-type authentication.
I'd misunderstood your point before.

So, if we store this "real" identity, is there any security issue
involved in exposing it to other users (via pg_stat_activity or
whatever)?

I remain concerned about the cost and inconvenience of exposing
it via log_line_prefix, but at least that shouldn't be visible
to anyone who's not entitled to know who's logged in ...

			regards, tom lane