X-Original-To: pgsql-sql@postgresql.org
Received: from spampd.localdomain (postgresql.org [64.49.215.8])
	by postgresql.org (Postfix) with ESMTP id 2053F475F09
	for <pgsql-sql@postgresql.org>; Mon, 24 Mar 2003 10:02:08 -0500 (EST)
Received: from sss.pgh.pa.us (unknown [192.204.191.242])
	by postgresql.org (Postfix) with ESMTP id 6062F475A8D
	for <pgsql-sql@postgresql.org>; Mon, 24 Mar 2003 10:02:03 -0500 (EST)
Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1])
	by sss.pgh.pa.us (8.12.8/8.12.8) with ESMTP id h2OF22ub012694;
	Mon, 24 Mar 2003 10:02:03 -0500 (EST)
To: Tomasz Myrta <jasiek@klaster.net>
Cc: "'pgsql-sql@postgresql.org'" <pgsql-sql@postgresql.org>
Subject: Re: function with security definer 
In-reply-to: <3E7ED5EE.9090104@klaster.net> 
References: <3E7ED5EE.9090104@klaster.net>
Comments: In-reply-to Tomasz Myrta <jasiek@klaster.net>
	message dated "Mon, 24 Mar 2003 10:54:54 +0100"
Date: Mon, 24 Mar 2003 10:02:02 -0500
Message-ID: <12693.1048518122@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
X-Spam-Status: No, hits=-32.5 required=5.0
	tests=BAYES_01,EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,
	REFERENCES,REPLY_WITH_QUOTES autolearn=ham	version=2.50
X-Spam-Level: 
X-Spam-Checker-Version: SpamAssassin 2.50 (1.173-2003-02-20-exp)
X-Archive-Number: 200303/546
X-Sequence-Number: 12584

Tomasz Myrta <jasiek@klaster.net> writes:
> [ Can't do SET SESSION AUTHORIZATION in a postgres-owned function ]

That's because SET SESSION AUTHORIZATION looks to the original login
userid, not the current effective userid, to decide whether you're
allowed to do it.  If it didn't work that way, a superuser couldn't
switch to any other identity after becoming a nonprivileged user.

I don't really see why you think this kluge is better than creating
multiple database users, anyway ...

			regards, tom lane