On 2019-12-18 15:09, Robert Haas wrote:
> I feel like this is taking a policy decision that properly belongs in
> pg_hba.conf and making it into a GUC. If you're introducing a GUC
> because it's not possible to configure the behavior that you want in
> pg_hba.conf, then I think the solution to that is to enhance
> pg_hba.conf so that it can support the behavior you want to configure.
Yeah, I was not really happy with that either. So I tried a new
approach: Introduce a new pg_hba.conf line type "localowner" that
matches on Unix-domain socket connections if the user at the client end
matches the owner of the postgres process. Then the behavior I'm after
can be expressed with a pg_hba.conf entry like
localowner all all trust
or similar, as one chooses.
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services