Question on any plans to use the Create Server/Create blink_ Mapping to provide Logical Replication Subscriptions the user/password in an encrypted manner

From: "Vitale, Anthony, Sony Music" <anthony(dot)vitale(at)sonymusic(dot)com>
To: "pgsql-hackers(at)lists(dot)postgresql(dot)org" <pgsql-hackers(at)lists(dot)postgresql(dot)org>
Subject: Question on any plans to use the Create Server/Create blink_ Mapping to provide Logical Replication Subscriptions the user/password in an encrypted manner
Date: 2025-07-15 13:58:17
Message-ID: AS8PR02MB1007812446C60E721F73CD33B9957A@AS8PR02MB10078.eurprd02.prod.outlook.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hello All

Postgresql dblinks and dblink_fdw allow for the use of Server and user mapping to be able to store the user/password of a connection and save it in an encrypted manner.

Logical replication subscription syntax regarding connection info allows for the user/password to be supplied within the subscription ddl.

And the Subscription connection info is visible via the pg_subscription.subconninfo column, which can contain plain-text passwords, is intentionally restricted. Only the pg_read_all_settings role, superusers, and the owner of the subscription can SELECT from this column.

In a dblink the connection info can be provided via the same connection parameters as allowed by the logical subscription syntax, however it is allowed to use a Created ServerName with a user mapping in the connections.

I am not familiar on what it would take to allow logical subscriptions to use User Server/Mapping logic as the dblink extension allows but if it where possible then this would assure that only the role creating the User server/mapping can set the connection user/password and then it can be totally hidden from prying eyes.

I was wondering if this is within any plan to implement in future releases.

Thanks
Anthony Vitale

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Bertrand Drouvot 2025-07-15 14:13:49 Re: Adding wait events statistics
Previous Message Álvaro Herrera 2025-07-15 13:40:38 Re: pg_dump does not dump domain not-null constraint's comments