Re: superusers are members of all roles?

* Andrew Dunstan (andrew(at)dunslane(dot)net) wrote:
> The surprising (to me) consequence was that every superuser was
> locked out of the system. I had not granted them (or anyone) the
> role, but nevertheless these lines took effect.

As I recall, the way we allow superusers to set role to other roles is
by considering the superuser to be a member of every role. Now, I agree
that such an approach doesn't make sense for pg_hba consideration.

> If this is intended, it should at least be documented. But if it is
> intended then it's ugly anyway, IMNSHO, and we should change it.

Perhaps the superuser-override should be moved to be at the 'set role'
level instead of setting things up such that the superuser is considered
a member of every role. That would fix this but would require adding a
couple of additional special superuser checks, which isn't something to
do lightly, imv.

Thanks,

Stephen