Bruce Momjian <pgman(at)candle(dot)pha(dot)pa(dot)us> writes:
> The only thing I can think of is to dump the groups out as files and
> enable those in pg_hba.conf, perhaps just like we allow @file includes.
> I would probably use % for group names and dump them in data/global.
> How does that sound?
You mean as files named after groups? That would add a large pile of
synchronization and security issues. (If you don't think there's a
security issue, consider a group named "../pg_hba.conf".)
My advice is not to do it.
regards, tom lane