Re: Can the current session be notified and refreshed with a newcredentials context? - Mailing list pgsql-general

From David G. Johnston
Subject Re: Can the current session be notified and refreshed with a newcredentials context?
Date
Msg-id CAKFQuwbTyJZthdOzP-jox8jQcmPmFKKODKBLeYk_J-KATGng8w@mail.gmail.com
Whole thread Raw
In response to Re: Can the current session be notified and refreshed with a newcredentials context?  (Ron <ronljohnsonjr@gmail.com>)
List pgsql-general
On Mon, Jun 22, 2020 at 2:21 PM Ron <ronljohnsonjr@gmail.com> wrote:
On 6/22/20 4:07 PM, AC Gomez wrote:
Suppose you have the following scenario:

1: Call some function with a certain user and password
2: From inside that function, have several calls using DBLink
3: At some point during the running of that function a password rotation(a separate process) comes along and updates the session user password and the User Mappings with this new rotated password
4: Now there is a discrepancy between the password used when the session started and the password in the User Mappings
5: The result is that on the next DBLink call the main function will fail because the session is still running with the old password but we have changed the User Mappings.

We have proven this by separating out every DBLINK call as its own new session and running password rotation in between dblink calls. Then things will work.

My question: Is there a way to update or refresh the session with the new password that was rotated so that the main function keeps running seamlessly through all it's DBLink calls?

If something like this is not available, then password rotation can only run when nothing else is running.

I've not seen such a thing on any system.

I don't use DBLink but I tend to agree that as written this seems more likely to be a user error type situation rather than an issue with the feature.  You should probably provide a (minimally) reproducing script for at least the client with annotations as to what is happening externally to the script as it is being run.

IOW, you don't get to keep the function a black box while also saying it is exactly the details of what is inside that function that is failing.

David J.

pgsql-general by date:

Previous
From: Ron
Date:
Subject: Re: Can the current session be notified and refreshed with a newcredentials context?
Next
From: Guy Burgess
Date:
Subject: Re: Feature suggestion: auto-prefixing SELECT query column names withtable/alias names