Feature request: Connection string parsing for postgres_fdw

2020-12-23 Thread Eric Hanson
I'm trying to store connection to postgres_fdw in the database I want to be able to store the full breadth of connection styles and all the different types of connections that libpq supports. But having some troubles. Postgres_fdw wants options passed into CREATE SERVER, all broken out into sepa

Re: Feature request: Connection string parsing for postgres_fdw

2020-12-23 Thread Eric Hanson
On Wed, Dec 23, 2020 at 5:39 AM Ashutosh Bapat wrote: > https://www.postgresql.org/docs/13/libpq-connect.html#LIBPQ-PARAMKEYWORDS > lists the parameters that postgres_fdw accepts. "dbname" can be more > than just dbname. See > https://www.postgresql.org/docs/13/libpq-connect.html#LIBPQ-CONNSTRING

Re: Feature request: Connection string parsing for postgres_fdw

2020-12-27 Thread Eric Hanson
Whoa that's perfect! Thank you so much. On Thu, Dec 24, 2020 at 4:59 PM Ian Lawrence Barwick wrote: > 2020年12月23日(水) 22:05 Eric Hanson : > > > > I'm trying to store connection to postgres_fdw in the database I want > to be able to store the full breadth of c

extensions are hitting the ceiling

2019-03-18 Thread Eric Hanson
Hi folks, After months and years of really trying to make EXTENSIONs meet the requirements of my machinations, I have come to the conclusion that either a) I am missing something or b) they are architecturally flawed. Or possibly both. Admittedly, I might be trying to push extensions beyond what

Re: extensions are hitting the ceiling

2019-03-19 Thread Eric Hanson
On Mon, Mar 18, 2019 at 11:56 PM Chapman Flack wrote: > On 03/18/19 22:38, Eric Hanson wrote: > > rows are really second class citizens: They aren't tracked with > > pg_catalog.pg_depend, they aren't deleted when the extension is dropped, > > etc. > > This.

SET LOCAL ROLE NO RESET -- sandbox transactions

2019-03-26 Thread Eric Hanson
Hi, I'm trying to use the PostgreSQL roles system as the user base for a web application. The common wisdom seems to be Don't Do This, because it requires a connection per-user which doesn't scale. However, thinking it through, I'm wondering it there might be a workaround using "sandbox transact

Re: SET LOCAL ROLE NO RESET -- sandbox transactions

2019-03-29 Thread Eric Hanson
These seem like much better ideas than mine. :-) Thanks. Did anything ever come of these ideas? Do you have a sense of the level of community support around these ideas? Thanks, Eric On Wed, Mar 27, 2019 at 11:23 AM Chapman Flack wrote: > On 3/27/19 2:40 AM, Eric Hanson wrote: > &g

Re: extensions are hitting the ceiling

2019-04-16 Thread Eric Hanson
On Tue, Apr 16, 2019 at 12:47 AM Noah Misch wrote: > On Mon, Mar 18, 2019 at 09:38:19PM -0500, Eric Hanson wrote: > > I have heard talk of a way to write extensions so that they dynamically > > reference the schema of their dependencies, but sure don't know how that &g

Re: extensions are hitting the ceiling

2019-04-16 Thread Eric Hanson
On Tue, Apr 16, 2019 at 4:24 AM Eric Hanson wrote: > > > On Tue, Apr 16, 2019 at 12:47 AM Noah Misch wrote: > >> On Mon, Mar 18, 2019 at 09:38:19PM -0500, Eric Hanson wrote: >> > I have heard talk of a way to write extensions so that they dynamically >>

Re: extensions are hitting the ceiling

2019-04-16 Thread Eric Hanson
On Tue, Apr 16, 2019 at 4:47 AM Eric Hanson wrote: > We would probably be wise to learn from what has gone (so I hear) terribly > wrong with the Node / NPM packaging system (and I'm sure many before it), > namely versioning. What happens when two extensions require different >

SET ROLE x NO RESET

2023-12-30 Thread Eric Hanson
Hi, What do you think of adding a NO RESET option to the SET ROLE command? Right now Postgres can enforce data security with roles and RLS, but role-per-end-user doesn't really scale: Db connections are per-role, so a connection pooler can't share connections across users. We can work around th

Re: SET ROLE x NO RESET

2024-01-05 Thread Eric Hanson
On Sat, Dec 30, 2023 at 11:50 AM Joe Conway wrote: > In the meantime, in case it helps, see > >https://github.com/pgaudit/set_user > > Specifically set_session_auth(text): > - > When set_session_auth(text) is called, the effective session and current > user is switched to the role

Proposal: Role Sandboxing for Secure Impersonation

2024-12-02 Thread Eric Hanson
Hi all, I'd like to revisit a previously discussed feature [1] that PostgreSQL could benefit from a "role sandbox", a feature that would build on SET [LOCAL] ROLE, and prevent or restrict RESET ROLE. Rationale: Connection pooling is widely used to optimize database performance by reducing use of

Re: Proposal: Role Sandboxing for Secure Impersonation

2024-12-05 Thread Eric Hanson
On Wed, Dec 4, 2024 at 4:54 PM Jelte Fennema-Nio wrote: > > > I wouldn't oppose a command that does an absolutely irrevocable SET > > ROLE -- i.e. once you execute it, it is as if you logged in as the > > target role originally, and the only way to get your privileges back > > is a new connection.

Re: Proposal: Role Sandboxing for Secure Impersonation

2024-12-04 Thread Eric Hanson
On Mon, Dec 2, 2024 at 10:31 AM Wolfgang Walther wrote: > Eric Hanson: > > a) Transaction ("local") Sandbox: > > - SET LOCAL ROLE alice NO RESET; > > - SET LOCAL ROLE alice WITHOUT RESET; > > - BEGIN AS ROLE alice; > > > > Transaction-level sa

Re: Proposal: Role Sandboxing for Secure Impersonation

2024-12-09 Thread Eric Hanson
On Thu, Dec 5, 2024 at 4:29 PM Jelte Fennema-Nio wrote: > When PgBouncer is in transaction mode, the server connection will only > be unlinked, when PgBouncer receives a ReadyForQuery with the "idle" > flag from the server **and** there are no messages from the client in > flight anymore. It's tot