From: | Jacob Champion <jchampion(at)timescale(dot)com> |
---|---|
To: | Andres Freund <andres(at)anarazel(dot)de> |
Cc: | Robert Haas <robertmhaas(at)gmail(dot)com>, Mark Dilger <mark(dot)dilger(at)enterprisedb(dot)com>, Jeff Davis <pgsql(at)j-davis(dot)com>, Amit Kapila <amit(dot)kapila16(at)gmail(dot)com>, Andrew Dunstan <andrew(at)dunslane(dot)net>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: Non-superuser subscription owners |
Date: | 2023-01-24 00:23:52 |
Message-ID: | f96c0b8d-2aca-21ad-717b-2a1beede6027@timescale.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On 1/23/23 11:05, Andres Freund wrote:
> There's not enough documentation for SYSTEM_USER imo.
If we were to make use of SYSTEM_USER programmatically (and based on
what Robert wrote downthread, that's probably not what's desired), I
think we'd have to make more guarantees about how it can be parsed and
the values that you can expect. Right now it's meant mostly for human
consumption.
>> You could even go a step further and disable ambient transport
>> authentication (sslcertmode=disable gssencmode=disable), which keeps a
>> proxied connection from making use of a client cert or a Kerberos cache. But
>> for postgres_fdw, at least, that carries a risk of disabling current use
>> cases. Stephen and I had a discussion about one such case in the Kerberos
>> delegation thread [1].
>
> I did not find that very convincing for today's code. The likelihood of
> something useful being prevented seems far far lower than preventing privilege
> leakage...
Fair enough. Preventing those credentials from being pulled in by
default would effectively neutralize my concern for the delegation
patchset, too.
--Jacob
From | Date | Subject | |
---|---|---|---|
Next Message | Jacob Champion | 2023-01-24 00:24:34 | Re: Non-superuser subscription owners |
Previous Message | James Coleman | 2023-01-23 23:42:45 | Re: Fix incorrect comment reference |