Re: postgres_fdw super user checks

On Tue, Oct 18, 2016 at 10:38 AM, Michael Paquier <michael(dot)paquier(at)gmail(dot)com
> wrote:

> On Mon, Oct 17, 2016 at 10:51 PM, Robert Haas <robertmhaas(at)gmail(dot)com>
> wrote:
> > On Mon, Oct 17, 2016 at 2:18 AM, Michael Paquier
> > <michael(dot)paquier(at)gmail(dot)com> wrote:
> >> On Mon, Oct 17, 2016 at 3:33 AM, Jeff Janes <jeff(dot)janes(at)gmail(dot)com>
> wrote:
> >>> postgres_fdw has some checks to enforce that non-superusers must
> connect to
> >>> the foreign server with a password-based method. The reason for this
> is to
> >>> prevent the authentication to the foreign server from happening on the
> basis
> >>> of the OS user who is running the non-foreign server.
> >>>
> >>> But I think these super user checks should be run against the userid
> of the
> >>> USER MAPPING being used for the connection, not the userid of currently
> >>> logged on user.
> >>
> >> So, if the user mapping user is a superuser locally, this would allow
> >> any lambda user of the local server to attempt a connection to the
> >> remote server. It looks dangerous rather dangerous to me to authorize
> >> that, even if the current behavior is a bit inconsistent I agree.
> >
> > I don't know what "any lambda user" means. Did you mean to write "any
> > random user"?
>
> Yes, in this context that would be "any non-superuser" or "any user
> without superuser rights". Actually that's a French-ism. I just
> translated it naturally to English to define a user that has no access
> to advanced features :)
>

Thanks for the patch, but it breaking the existing functionality as per the
other
mails. Marked as "returned with feedback" in 2016-11 commitfest.

Regards,
Hari Babu
Fujitsu Australia