From f66c8252ab9a64dd49a0af2b481a2621dd008768 Mon Sep 17 00:00:00 2001 From: Andrew Dunstan Date: Thu, 3 Nov 2011 16:29:41 -0400 Subject: [PATCH] Role membership of superusers is only by explicit membership for HBA. Document that this rule applies to 'samerole' as well as to named roles. Per gripe from Tom Lane. --- doc/src/sgml/client-auth.sgml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml index 6493d302c7f..31ce45d4ca2 100644 --- a/doc/src/sgml/client-auth.sgml +++ b/doc/src/sgml/client-auth.sgml @@ -186,6 +186,10 @@ hostnossl database user the requested user must be a member of the role with the same name as the requested database. (samegroup is an obsolete but still accepted spelling of samerole.) + Superusers are not considered to be members of a role for the + purposes of samerole unless they are explicitly + members of the role, directly or indirectly, and not just by + virtue of being a superuser. The value replication specifies that the record matches if a replication connection is requested (note that replication connections do not specify any particular database). -- 2.30.2