MIME-Version: 1.0
References: <66f55a6b9ff7bdd6bfd0d05e8fd8351690e69e23.camel@j-davis.com>
 <CAAWbhmiL=kWT=Oc=SA-U9-NnVSPGmPmzD4aNQEtahxXpCDrH0A@mail.gmail.com>
 <CA+Tgmoa+CLg8JW_Rj12pmj2Y+0D=r339yryHQmdGAdd56PcdYw@mail.gmail.com>
 <CA+TgmoamMHL2BTiMOVJtjAfHOy984=42Dvq8B0k+=p4rhYKCKw@mail.gmail.com>
 <6ef7d0b0-3255-68c3-73b2-e6023b241222@timescale.com> <CA+Tgmobc_KUw1CnP4--Zss3Y_FhAnb+FyXHwn9Ej9jTBHM238A@mail.gmail.com>
 <CAAWbhmgnLt57UH7j6VECLbxr5G9gAuJX__iXos7kF8fAnY_NqA@mail.gmail.com>
 <CA+TgmoaNCKdVp4ur0QGjVdeETYNC-hpDArQuyDNTJM3-rJdWQg@mail.gmail.com>
 <0768cedb-695a-8841-5f8b-da2aa64c8f3a@timescale.com> <CA+TgmobpVTMan6zR8rgBNcamc1Hwn0uH-gjuOR9DLB1H-h+saQ@mail.gmail.com>
 <CAAWbhmhV6JqcCpy+6qTs75OCVpkm+FviMKuZhewDQdSdbg+1bg@mail.gmail.com>
 <CA+TgmobJ1sGukOjSZT3vh=7MxW33UKdm6HWVmDbZRGwtn_rKCw@mail.gmail.com>
 <CAAWbhmi-PvUif0c5V=p99Bc4TA20nTim7K4o0x6HXnRVGKpo9A@mail.gmail.com>
 <CA+TgmoZvSSRYAdfppHiYC25CB1f2s5fNvSJ=0kMEGdicRdk2dg@mail.gmail.com>
 <cb43e26f-d897-447c-a795-b3954815f371@timescale.com> <CA+Tgmobit_-XTGJxZ0kzxJ7KSasQShxJz-oBGJCDbzPjL6s2-g@mail.gmail.com>
 <CAAWbhmg25XaA=s04y7_LK8Q7-GSBw09fH2A5iiFESUbVaFXWqg@mail.gmail.com>
 <CA+TgmoYBF75-MQ02K=4-JA02YvfLA1bsWdbjQP=evfjJGigsbA@mail.gmail.com> <CAAWbhmhPFvV=TyGw0GfdLNUR6GMU0Ntcg6fEuhTNcha6f2oGig@mail.gmail.com>
In-Reply-To: <CAAWbhmhPFvV=TyGw0GfdLNUR6GMU0Ntcg6fEuhTNcha6f2oGig@mail.gmail.com>
From: Robert Haas <robertmhaas@gmail.com>
Date: Thu, 9 Mar 2023 09:12:37 -0500
Message-ID: <CA+TgmoZJCxNVRHTWZz5-e3FZx5Qvn3a8KPMc7CSfcCRqQSt_3Q@mail.gmail.com>
Subject: Re: postgres_fdw, dblink, and CREATE SUBSCRIPTION security
To: Jacob Champion <jchampion@timescale.com>
Cc: Andres Freund <andres@anarazel.de>, Mark Dilger <mark.dilger@enterprisedb.com>, 
	Jeff Davis <pgsql@j-davis.com>, Amit Kapila <amit.kapila16@gmail.com>, 
	Andrew Dunstan <andrew@dunslane.net>, PostgreSQL-development <pgsql-hackers@postgresql.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CA%2BTgmoZJCxNVRHTWZz5-e3FZx5Qvn3a8KPMc7CSfcCRqQSt_3Q%40mail.gmail.com>
Precedence: bulk

On Wed, Mar 8, 2023 at 5:44=E2=80=AFPM Jacob Champion <jchampion@timescale.=
com> wrote:
>
> On Wed, Mar 8, 2023 at 11:40=E2=80=AFAM Robert Haas <robertmhaas@gmail.co=
m> wrote:
> > On Wed, Mar 8, 2023 at 2:30=E2=80=AFPM Jacob Champion <jchampion@timesc=
ale.com> wrote:
> > > I don't think I necessarily like that option better than SASL-style,
> > > but hopefully that clarifies it somewhat?
> >
> > Hmm, yeah, I guess that's OK.
>
> Okay, cool.
>
> > I still don't love it, though. It feels
> > more solid to me if the proxy can actually block the connections
> > before they even happen, without having to rely on a server
> > interaction to figure out what is permissible.
>
> Sure. I don't see a way for the proxy to figure that out by itself,
> though, going back to my asymmetry argument from before. Only the
> server truly knows, at time of HBA processing, whether the proxy
> itself has authority. If the proxy knew, it wouldn't be confused.
>
> > I don't know what you mean by SASL-style, exactly.
>
> That's the one where the server explicitly names all forms of
> authentication, including the ambient ones (ANONYMOUS, EXTERNAL,
> etc.), and requires the client to choose one before running any
> actions on their behalf. That lets the require_auth machinery work for
> this case, too.
>
> --Jacob


--=20
Robert Haas
EDB: http://www.enterprisedb.com