On 1/23/23 11:05, Andres Freund wrote:
> There's not enough documentation for SYSTEM_USER imo.
If we were to make use of SYSTEM_USER programmatically (and based on
what Robert wrote downthread, that's probably not what's desired), I
think we'd have to make more guarantees about how it can be parsed and
the values that you can expect. Right now it's meant mostly for human
consumption.
>> You could even go a step further and disable ambient transport
>> authentication (sslcertmode=disable gssencmode=disable), which keeps a
>> proxied connection from making use of a client cert or a Kerberos cache. But
>> for postgres_fdw, at least, that carries a risk of disabling current use
>> cases. Stephen and I had a discussion about one such case in the Kerberos
>> delegation thread [1].
>
> I did not find that very convincing for today's code. The likelihood of
> something useful being prevented seems far far lower than preventing privilege
> leakage...
Fair enough. Preventing those credentials from being pulled in by
default would effectively neutralize my concern for the delegation
patchset, too.
--Jacob
