On Mon, Oct 17, 2016 at 11:48 AM, Michael Paquier <michael.paqu...@gmail.com> wrote: > On Mon, Oct 17, 2016 at 3:33 AM, Jeff Janes <jeff.ja...@gmail.com> wrote: >> postgres_fdw has some checks to enforce that non-superusers must connect to >> the foreign server with a password-based method. The reason for this is to >> prevent the authentication to the foreign server from happening on the basis >> of the OS user who is running the non-foreign server. >> >> But I think these super user checks should be run against the userid of the >> USER MAPPING being used for the connection, not the userid of currently >> logged on user. > > So, if the user mapping user is a superuser locally, this would allow > any lambda user of the local server to attempt a connection to the > remote server. It looks dangerous rather dangerous to me to authorize > that, even if the current behavior is a bit inconsistent I agree.
A lambda user can use a user mapping same as a superuser if a. that user mapping is public and/or b. it uses a view owned by super user (RangeTblEntry::checkuser). When a is true but not b, the the user in UserMapping is set to lambda and not superuser, so this patch is correct here. If b is true, and lambda is able to access the view, the superuser has granted it permissions to do so and thus intends to let lambda use a super user user mapping. Since we trust super users to do the right thing, I don't see why it's unsafe. Any other objects accesses by lambda, will use a different user mapping based on the object being accessed. Best Wishes, Ashutosh Bapat EnterpriseDB Corporation The Postgres Database Company -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
