Re: Can the current session be notified and refreshed with a newcredentials context? - Mailing list pgsql-general

From AC Gomez
Subject Re: Can the current session be notified and refreshed with a newcredentials context?
Date
Msg-id CABtmK-g3jVU=XA0yRcoCLcdoNqXR5Fw+ZM997N-pboLm4mt-gA@mail.gmail.com
Whole thread Raw
In response to Re: Can the current session be notified and refreshed with a new credentials context?  (Tom Lane <tgl@sss.pgh.pa.us>)
Responses Re: Can the current session be notified and refreshed with a new credentials context?  (Tom Lane <tgl@sss.pgh.pa.us>)
List pgsql-general
We do hold the original session open. The problem comes when we change the password while that session is open, now the session and the User Mappings are out of synch and we have failure.

On Mon, Jun 22, 2020, 6:08 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
AC Gomez <antklc@gmail.com> writes:
> Suppose you have the following scenario:
> 1: Call some function with a certain user and password
> 2: From inside that function, have several calls using DBLink
> 3: At some point during the running of that function a password rotation(a
> separate process) comes along and updates the session user password and the
> User Mappings with this new rotated password
> 4: Now there is a discrepancy between the password used when the session
> started and the password in the User Mappings
> 5: The result is that on the next DBLink call the main function will fail
> because the session is still running with the old password but we have
> changed the User Mappings.

> We have proven this by separating out every DBLINK call as its own new
> session and running password rotation in between dblink calls. Then things
> will work.

If you hold the original dblink session open throughout the function,
password changes after that session is opened won't matter.  Why are you
opening new sessions?  It's inefficient as well as introducing unnecessary
chances for failure.

                        regards, tom lane

pgsql-general by date:

Previous
From: Tom Lane
Date:
Subject: Re: Can the current session be notified and refreshed with a new credentials context?
Next
From: Tom Lane
Date:
Subject: Re: Can the current session be notified and refreshed with a new credentials context?