#34200: Allow setting postgres role during connection setup
-------------------------------------+-------------------------------------
Reporter: Mike Crute | Owner: Mike
| Crute
Type: New feature | Status: closed
Component: Database layer | Version: 4.1
(models, ORM) |
Severity: Normal | Resolution: needsinfo
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Mike Crute):
Replying to [comment:4 Mariusz Felisiak]:
> Thanks for the ticket, however I don't see anything "straightforward"
about this solution, it seems complicated and quite niche. All the role-
juggling looks like something the DBA should do, not something that
framework is responsible for.
Agreed that the role juggling should be done by a DBA or whomever is
responsible for setting up the database but I **do** think it's the job of
the framework to assume the correct role at runtime. There's no way for a
DBA to force an application to assume a role by default in postgres. It
has to be done by executing a statement on the newly opened connection.
As for niche: in my experience, using ephemeral credentials that are
leased from a (proprietary) credential management system is pretty common
in really large companies that have strong controls around accounts and
security. Also this is definitely a problem for anyone using Hashicorp
Vault for credential management which I would suggest is not particularly
niche.
> Also, is it not already possible to `SET ROLE` in `DATABASE["OPTIONS"]`?
(see [https://docs.djangoproject.com/en/stable/ref/settings/#std-setting-
OPTIONS docs])
Perhaps I'm missing something but I do not see how this is possible in the
current settings. The connection setup logic must execute `SET ROLE
<role>` against a cursor to set the role. It's not a client option that
can just be passed through as far as I'm aware.
--
Ticket URL: <https://code.djangoproject.com/ticket/34200#comment:5>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/01070184e5d0561f-d20f508b-7031-4c5d-90e4-87ff513fd9ad-000000%40eu-central-1.amazonses.com.
