Proposal to sync SET ROLE and pg_stat_activity

From: Grant Finnemore <grant(at)guruhut(dot)com>
To: PostgreSQL Developers <pgsql-hackers(at)postgresql(dot)org>
Subject: Proposal to sync SET ROLE and pg_stat_activity
Date: 2008-08-25 20:57:19
Message-ID: 48B31CAF.4070705@guruhut.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi,

In the manual for SET ROLE, it's noted that an invocation of SET ROLE
will leave the session_user unchanged, but will change the current_user.

Invoking pg_stat_activity after the SET ROLE is changed will however
leave the usename unchanged. (Also from the manual we note that a
snapshot is taken at the first call, although in the case of
current_query and others, the field is updated at regular intervals)

SET SESSION AUTHORIZATION behaves similarly, although in that case,
it's documented that both session_user and current_user are changed
to reflect the new user.

An example:-

test=# select current_user, session_user;
current_user | session_user
--------------+--------------
grant | grant
(1 row)

test=# select usename from pg_stat_activity;
usename
---------
grant
(1 row)

test=# set session role bob;
SET
test=> select current_user, session_user;
current_user | session_user
--------------+--------------
bob | grant
(1 row)

test=> select usename from pg_stat_activity;
usename
---------
grant
(1 row)

I have on occasion used a database pooling scheme that whenever a
connection is retrieved from the pool, either a SET ROLE or SET
SESSION AUTHORIZATION is issued to enable database level access
restrictions. Similarly, when the connection is returned, a RESET
instruction is issued.

IMHO, it would be advantageous to be able to display which
connections are in use by a given user through the pg_stat_activity
view. Looking through the archives, I've found one other request
for this which AFAICS wasn't answered.

http://archives.postgresql.org/pgsql-bugs/2007-04/msg00035.php

There are two ways in which this could be done. Firstly, we could
alter the current usename field in the view. This would keep the
view definition the same, but would alter the semantics, which could
affect existing clients. Alternatively, we could introduce another
column that would reflect the role name.

I attach a patch that kinda works for the SET SESSION AUTH case, and
will undertake to complete the work should there be some general
support for this proposal.

Comments?

Regards,
Grant Finnemore

Attachment Content-Type Size
patch.session_auth_update.20080825 text/plain 2.6 KB

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Magnus Hagander 2008-08-25 21:23:45 Re: Should enum GUCs be listed as such in config.sgml?
Previous Message Peter Schuller 2008-08-25 20:39:07 Implementing cost limit/delays for insert/delete/update/select