| From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
|---|---|
| To: | "David G(dot) Johnston" <david(dot)g(dot)johnston(at)gmail(dot)com> |
| Cc: | CN <cnliou9(at)fastmail(dot)fm>, "pgsql-general(at)postgresql(dot)org" <pgsql-general(at)postgresql(dot)org> |
| Subject: | Re: Switching roles as an replacement of connection pooling tools |
| Date: | 2016-05-31 14:48:46 |
| Message-ID: | 2370.1464706126@sss.pgh.pa.us |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-general |
"David G. Johnston" <david(dot)g(dot)johnston(at)gmail(dot)com> writes:
> Is there a reason something "SET ROLE ... WITH SETTINGS" couldn't be
> implemented?
Unless there's something underlying that proposal that I'm not seeing,
it only deals with one of the problems in this area. The security-
related issues remain unsolved.
AFAICS there's a pretty fundamental tension here around the question
of how hard it is to revert to the original role. If it's not possible
to do that then a connection pooler can't serially reuse a connection for
different users, which largely defeats the point. If it is possible, how
do you keep that from being a security hole, ie one of the pool users can
gain privileges of another one?
(And, btw, I repeat that all of this has been discussed before on our
lists.)
regards, tom lane
| From | Date | Subject | |
|---|---|---|---|
| Next Message | David G. Johnston | 2016-05-31 15:05:18 | Re: Switching roles as an replacement of connection pooling tools |
| Previous Message | Achilleas Mantzios | 2016-05-31 14:37:38 | Re: Switching roles as an replacement of connection pooling tools |