On Sat, 2023-01-21 at 14:01 -0800, Andres Freund wrote: > There are good reasons to have 'peer' authentication set up for the > user > running postgres, so admin scripts can connect without issues. Which > unfortunately then also means that postgres_fdw etc can connect to > the current > database as superuser, without that check. Which imo clearly is an > issue.
Perhaps we should have a way to directly turn on/off authentication methods in libpq through API functions and/or options? This reminds me of the "channel_binding=required" option. We considered some similar alternatives for that feature. > Why is this only about local files, rather than e.g. also using the > local > user? It's not, but we happen to already have pg_read_server_files, and it makes sense to use that at least for files referenced directly in the connection string. You're right that it's incomplete, and also that it doesn't make a lot of sense for files accessed indirectly. -- Jeff Davis PostgreSQL Contributor Team - AWS
