Re: Any way to have CREATEUSER privs without having all privs? - Mailing list pgsql-general

From Bruno Wolff III
Subject Re: Any way to have CREATEUSER privs without having all privs?
Date
Msg-id 20040107151911.GA6088@wolff.to
Whole thread Raw
In response to Re: Any way to have CREATEUSER privs without having all privs?  (Bruno Wolff III <bruno@wolff.to>)
List pgsql-general
On Sat, Dec 06, 2003 at 22:33:00 -0800,
  Ezra Epstein <sf-lists@prajnait.com> wrote:
> Thank you Bruno for the informative reply.
>
> I'm not sure how ident solves this.  I would like the session to run as the
> actual user (via set session authorization) so that that user's actual privs
> are enforced.  But I want the connection to be shared: so it cannot be per
> login (username/pw combo).  I'm not up on ident enough to see the fit.  Any
> pointers would be most welcome.

I was wrong about this being useful in your situation. SET SESSION
AUTHORIZATION doesn't reauthenticate, it only allows you to switch
to a new user if you originally were connected as a superuser.

Ident authentication would only be useful if you could close and then
reopen the connection. This could be useful if the overhead of doing
this wasn't a concern.

pgsql-general by date:

Previous
From: Tim McAuley
Date:
Subject: deadlocks - sharelocks on transactions
Next
From: Bruno Wolff III
Date:
Subject: Re: problems with transaction blocks