Re: postgres_fdw super user checks

On Mon, Oct 17, 2016 at 10:51 PM, Robert Haas <robertmhaas@gmail.com> wrote:
> On Mon, Oct 17, 2016 at 2:18 AM, Michael Paquier
> <michael.paquier@gmail.com> wrote:
>> On Mon, Oct 17, 2016 at 3:33 AM, Jeff Janes <jeff.janes@gmail.com> wrote:
>>> postgres_fdw has some checks to enforce that non-superusers must connect to
>>> the foreign server with a password-based method.  The reason for this is to
>>> prevent the authentication to the foreign server from happening on the basis
>>> of the OS user who is running the non-foreign server.
>>>
>>> But I think these super user checks should be run against the userid of the
>>> USER MAPPING being used for the connection, not the userid of currently
>>> logged on user.
>>
>> So, if the user mapping user is a superuser locally, this would allow
>> any lambda user of the local server to attempt a connection to the
>> remote server. It looks dangerous rather dangerous to me to authorize
>> that, even if the current behavior is a bit inconsistent I agree.
>
> I don't know what "any lambda user" means.  Did you mean to write "any
> random user"?

Yes, in this context that would be "any non-superuser" or "any user
without superuser rights". Actually that's a French-ism. I just
translated it naturally to English to define a user that has no access
to advanced features :)
-- 
Michael