* Andrew Dunstan (and...@dunslane.net) wrote: > The surprising (to me) consequence was that every superuser was > locked out of the system. I had not granted them (or anyone) the > role, but nevertheless these lines took effect.
As I recall, the way we allow superusers to set role to other roles is by considering the superuser to be a member of every role. Now, I agree that such an approach doesn't make sense for pg_hba consideration. > If this is intended, it should at least be documented. But if it is > intended then it's ugly anyway, IMNSHO, and we should change it. Perhaps the superuser-override should be moved to be at the 'set role' level instead of setting things up such that the superuser is considered a member of every role. That would fix this but would require adding a couple of additional special superuser checks, which isn't something to do lightly, imv. Thanks, Stephen
signature.asc
Description: Digital signature