diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml
index 26a70c9f483d5c25b29a9efb0cf559a4e6fe091c..2185eebeb05cd8e21223cc528cb3707f9e59192e 100644
--- a/doc/src/sgml/client-auth.sgml
+++ b/doc/src/sgml/client-auth.sgml
@@ -1,4 +1,4 @@
-<!-- $PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.87 2006/03/10 19:10:47 momjian Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.88 2006/04/30 02:09:06 momjian Exp $ -->
<chapter id="client-authentication">
<title>Client Authentication</title>
@@ -206,6 +206,8 @@ hostnossl <replaceable>database</replaceable> <replaceable>user</replaceable>
Multiple user names can be supplied by separating them with commas.
A separate file containing user names can be specified by preceding the
file name with <literal>@</>.
+ User and group connectivity can also be restricted by <command>GRANT
+ CONNECTION ON DATABASE</>.
</para>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/ref/grant.sgml b/doc/src/sgml/ref/grant.sgml
index 1ae5b4803483ca2026092c8e5ca097758699992b..03060f97212957c50a4d03e477768145a446385e 100644
--- a/doc/src/sgml/ref/grant.sgml
+++ b/doc/src/sgml/ref/grant.sgml
@@ -1,5 +1,5 @@
<!--
-$PostgreSQL: pgsql/doc/src/sgml/ref/grant.sgml,v 1.52 2006/02/14 03:32:14 momjian Exp $
+$PostgreSQL: pgsql/doc/src/sgml/ref/grant.sgml,v 1.53 2006/04/30 02:09:06 momjian Exp $
PostgreSQL documentation
-->
@@ -30,7 +30,7 @@ GRANT { { USAGE | SELECT | UPDATE }
ON SEQUENCE <replaceable class="PARAMETER">sequencename</replaceable> [, ...]
TO { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
-GRANT { { CREATE | TEMPORARY | TEMP } [,...] | ALL [ PRIVILEGES ] }
+GRANT { { CREATE | TEMPORARY | TEMP | CONNECTION } [,...] | ALL [ PRIVILEGES ] }
ON DATABASE <replaceable>dbname</replaceable> [, ...]
TO { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
@@ -229,6 +229,18 @@ GRANT <replaceable class="PARAMETER">role</replaceable> [, ...]
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>CONNECTION</term>
+ <listitem>
+ <para>
+ Allows the ability to connect to the specified database.
+ By default, Grant permissions allow users to connect to any database,
+ though <filename>pg_hba.conf</> can add additional connection
+ restrictions.
+ </para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term>TEMPORARY</term>
<term>TEMP</term>
@@ -417,6 +429,7 @@ GRANT <replaceable class="PARAMETER">role</replaceable> [, ...]
X -- EXECUTE
U -- USAGE
C -- CREATE
+ c -- CONNECTION
T -- TEMPORARY
arwdRxt -- ALL PRIVILEGES (for tables)
* -- grant option for preceding privilege
diff --git a/doc/src/sgml/ref/revoke.sgml b/doc/src/sgml/ref/revoke.sgml
index f09642a7b5ec7e564347bf6e64f2e81c044a4d8e..034b946111c7a693b7372d14e174ab29eebc10c0 100644
--- a/doc/src/sgml/ref/revoke.sgml
+++ b/doc/src/sgml/ref/revoke.sgml
@@ -1,5 +1,5 @@
<!--
-$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.36 2006/01/21 02:16:18 momjian Exp $
+$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.37 2006/04/30 02:09:06 momjian Exp $
PostgreSQL documentation
-->
@@ -35,7 +35,7 @@ REVOKE [ GRANT OPTION FOR ]
[ CASCADE | RESTRICT ]
REVOKE [ GRANT OPTION FOR ]
- { { CREATE | TEMPORARY | TEMP } [,...] | ALL [ PRIVILEGES ] }
+ { { CREATE | TEMPORARY | TEMP | CONNECTION } [,...] | ALL [ PRIVILEGES ] }
ON DATABASE <replaceable>dbname</replaceable> [, ...]
FROM { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
[ CASCADE | RESTRICT ]
diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 4961e7a22cd36aea20062ad2859fb0be5574a9ec..3b9701db077bf038cfdcd4d43d79c2e8f360dc02 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/backend/catalog/aclchk.c,v 1.125 2006/03/05 15:58:22 momjian Exp $
+ * $PostgreSQL: pgsql/src/backend/catalog/aclchk.c,v 1.126 2006/04/30 02:09:07 momjian Exp $
*
* NOTES
* See acl.h.
@@ -1368,6 +1368,8 @@ string_to_privilege(const char *privname)
return ACL_CREATE_TEMP;
if (strcmp(privname, "temp") == 0)
return ACL_CREATE_TEMP;
+ if (strcmp(privname, "connection") == 0)
+ return ACL_CONNECT;
ereport(ERROR,
(errcode(ERRCODE_SYNTAX_ERROR),
errmsg("unrecognized privilege type \"%s\"", privname)));
@@ -1401,6 +1403,8 @@ privilege_to_string(AclMode privilege)
return "CREATE";
case ACL_CREATE_TEMP:
return "TEMP";
+ case ACL_CONNECT:
+ return "CONNECTION";
default:
elog(ERROR, "unrecognized privilege: %d", (int) privilege);
}
diff --git a/src/backend/utils/adt/acl.c b/src/backend/utils/adt/acl.c
index 67336e53b1ceaa34b081895a18cd6eded0757e37..4f64104ad3de7f1cf600031d229933438c9c0a42 100644
--- a/src/backend/utils/adt/acl.c
+++ b/src/backend/utils/adt/acl.c
@@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/backend/utils/adt/acl.c,v 1.131 2006/03/05 15:58:40 momjian Exp $
+ * $PostgreSQL: pgsql/src/backend/utils/adt/acl.c,v 1.132 2006/04/30 02:09:07 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@@ -287,6 +287,9 @@ aclparse(const char *s, AclItem *aip)
case ACL_CREATE_TEMP_CHR:
read = ACL_CREATE_TEMP;
break;
+ case ACL_CONNECT_CHR:
+ read = ACL_CONNECT;
+ break;
default:
ereport(ERROR,
(errcode(ERRCODE_INVALID_TEXT_REPRESENTATION),
@@ -550,7 +553,7 @@ acldefault(GrantObjectType objtype, Oid ownerId)
owner_default = ACL_ALL_RIGHTS_SEQUENCE;
break;
case ACL_OBJECT_DATABASE:
- world_default = ACL_CREATE_TEMP; /* not NO_RIGHTS! */
+ world_default = ACL_CREATE_TEMP | ACL_CONNECT; /* not NO_RIGHTS! */
owner_default = ACL_ALL_RIGHTS_DATABASE;
break;
case ACL_OBJECT_FUNCTION:
diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c
index 3c4c0feeef02934d2f9c2988aee86f33280d99c1..63135d2d1e305862030a43cfc13403c0f80b383c 100644
--- a/src/backend/utils/init/postinit.c
+++ b/src/backend/utils/init/postinit.c
@@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/backend/utils/init/postinit.c,v 1.162 2006/03/29 21:17:39 tgl Exp $
+ * $PostgreSQL: pgsql/src/backend/utils/init/postinit.c,v 1.163 2006/04/30 02:09:07 momjian Exp $
*
*
*-------------------------------------------------------------------------
@@ -51,7 +51,7 @@
static bool FindMyDatabase(const char *name, Oid *db_id, Oid *db_tablespace);
-static void ReverifyMyDatabase(const char *name);
+static void ReverifyMyDatabase(const char *name, const char *user_name);
static void InitCommunication(void);
static void ShutdownPostgres(int code, Datum arg);
static bool ThereIsAtLeastOneRole(void);
@@ -130,8 +130,9 @@ FindMyDatabase(const char *name, Oid *db_id, Oid *db_tablespace)
* during session startup, this place is also fitting to set up any
* database-specific configuration variables.
*/
+
static void
-ReverifyMyDatabase(const char *name)
+ReverifyMyDatabase(const char *name, const char *user_name)
{
Relation pgdbrel;
SysScanDesc pgdbscan;
@@ -211,6 +212,23 @@ ReverifyMyDatabase(const char *name)
(errcode(ERRCODE_TOO_MANY_CONNECTIONS),
errmsg("too many connections for database \"%s\"",
name)));
+
+ /*
+ * Checking for privilege to connect to the database
+ * We want to bypass the test if we are running in bootstrap mode
+ */
+ if (!IsBootstrapProcessingMode())
+ {
+ if(pg_database_aclcheck(MyDatabaseId,GetUserId()
+ ,ACL_CONNECT) != ACLCHECK_OK )
+ {
+ ereport(FATAL,
+ (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+ errmsg("couldn't connect to database %s", NameStr(dbform->datname)),
+ errdetail("User %s doesn't have the CONNECTION privilege for database %s.",
+ user_name, NameStr(dbform->datname))));
+ }
+ }
}
/*
@@ -487,7 +505,7 @@ InitPostgres(const char *dbname, const char *username)
* superuser, so the above stuff has to happen first.)
*/
if (!bootstrap)
- ReverifyMyDatabase(dbname);
+ ReverifyMyDatabase(dbname,username);
/*
* Final phase of relation cache startup: write a new cache file if
diff --git a/src/include/catalog/catversion.h b/src/include/catalog/catversion.h
index ff44afe90923d6ed3c5e23a1c997b854b2383908..f3c037f97c071460fc8a37a8181dcb8fe7feba96 100644
--- a/src/include/catalog/catversion.h
+++ b/src/include/catalog/catversion.h
@@ -37,7 +37,7 @@
* Portions Copyright (c) 1996-2006, PostgreSQL Global Development Group
* Portions Copyright (c) 1994, Regents of the University of California
*
- * $PostgreSQL: pgsql/src/include/catalog/catversion.h,v 1.326 2006/04/26 22:33:13 momjian Exp $
+ * $PostgreSQL: pgsql/src/include/catalog/catversion.h,v 1.327 2006/04/30 02:09:07 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@@ -53,6 +53,6 @@
*/
/* yyyymmddN */
-#define CATALOG_VERSION_NO 200604262
+#define CATALOG_VERSION_NO 200604291
#endif
diff --git a/src/include/nodes/parsenodes.h b/src/include/nodes/parsenodes.h
index 2da0f6605dd2d3e76ff7fa2a45d9c2b557853dd8..a0a31be51be06a0b005f135f5348682aa843f5c3 100644
--- a/src/include/nodes/parsenodes.h
+++ b/src/include/nodes/parsenodes.h
@@ -7,7 +7,7 @@
* Portions Copyright (c) 1996-2006, PostgreSQL Global Development Group
* Portions Copyright (c) 1994, Regents of the University of California
*
- * $PostgreSQL: pgsql/src/include/nodes/parsenodes.h,v 1.308 2006/04/27 00:33:46 momjian Exp $
+ * $PostgreSQL: pgsql/src/include/nodes/parsenodes.h,v 1.309 2006/04/30 02:09:07 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@@ -57,7 +57,8 @@ typedef uint32 AclMode; /* a bitmask of privilege bits */
#define ACL_USAGE (1<<8) /* for languages and namespaces */
#define ACL_CREATE (1<<9) /* for namespaces and databases */
#define ACL_CREATE_TEMP (1<<10) /* for databases */
-#define N_ACL_RIGHTS 11 /* 1 plus the last 1<<x */
+#define ACL_CONNECT (1<<11) /* for database connection privilege */
+#define N_ACL_RIGHTS 12 /* 1 plus the last 1<<x */
#define ACL_NO_RIGHTS 0
/* Currently, SELECT ... FOR UPDATE/FOR SHARE requires UPDATE privileges */
#define ACL_SELECT_FOR_UPDATE ACL_UPDATE
diff --git a/src/include/utils/acl.h b/src/include/utils/acl.h
index af6b0ee90c56483048e61c85c1e1d4f72840384d..c329b6aab81d16a2d9ece7352d5d016c5306e475 100644
--- a/src/include/utils/acl.h
+++ b/src/include/utils/acl.h
@@ -7,7 +7,7 @@
* Portions Copyright (c) 1996-2006, PostgreSQL Global Development Group
* Portions Copyright (c) 1994, Regents of the University of California
*
- * $PostgreSQL: pgsql/src/include/utils/acl.h,v 1.93 2006/03/05 15:59:06 momjian Exp $
+ * $PostgreSQL: pgsql/src/include/utils/acl.h,v 1.94 2006/04/30 02:09:07 momjian Exp $
*
* NOTES
* An ACL array is simply an array of AclItems, representing the union
@@ -135,16 +135,17 @@ typedef ArrayType Acl;
#define ACL_USAGE_CHR 'U'
#define ACL_CREATE_CHR 'C'
#define ACL_CREATE_TEMP_CHR 'T'
+#define ACL_CONNECT_CHR 'c'
/* string holding all privilege code chars, in order by bitmask position */
-#define ACL_ALL_RIGHTS_STR "arwdRxtXUCT"
+#define ACL_ALL_RIGHTS_STR "arwdRxtXUCTc"
/*
* Bitmasks defining "all rights" for each supported object type
*/
#define ACL_ALL_RIGHTS_RELATION (ACL_INSERT|ACL_SELECT|ACL_UPDATE|ACL_DELETE|ACL_RULE|ACL_REFERENCES|ACL_TRIGGER)
#define ACL_ALL_RIGHTS_SEQUENCE (ACL_USAGE|ACL_SELECT|ACL_UPDATE)
-#define ACL_ALL_RIGHTS_DATABASE (ACL_CREATE|ACL_CREATE_TEMP)
+#define ACL_ALL_RIGHTS_DATABASE (ACL_CREATE|ACL_CREATE_TEMP|ACL_CONNECT )
#define ACL_ALL_RIGHTS_FUNCTION (ACL_EXECUTE)
#define ACL_ALL_RIGHTS_LANGUAGE (ACL_USAGE)
#define ACL_ALL_RIGHTS_NAMESPACE (ACL_USAGE|ACL_CREATE)