From f66c8252ab9a64dd49a0af2b481a2621dd008768 Mon Sep 17 00:00:00 2001
From: Andrew Dunstan <andrew@dunslane.net>
Date: Thu, 3 Nov 2011 16:29:41 -0400
Subject: [PATCH] Role membership of superusers is only by explicit membership
for HBA.
Document that this rule applies to 'samerole' as well as to named roles.
Per gripe from Tom Lane.
---
doc/src/sgml/client-auth.sgml | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml
index 6493d302c7f..31ce45d4ca2 100644
--- a/doc/src/sgml/client-auth.sgml
+++ b/doc/src/sgml/client-auth.sgml
@@ -186,6 +186,10 @@ hostnossl <replaceable>database</replaceable> <replaceable>user</replaceable>
the requested user must be a member of the role with the same
name as the requested database. (<literal>samegroup</> is an
obsolete but still accepted spelling of <literal>samerole</>.)
+ Superusers are not considered to be members of a role for the
+ purposes of <literal>samerole</> unless they are explicitly
+ members of the role, directly or indirectly, and not just by
+ virtue of being a superuser.
The value <literal>replication</> specifies that the record
matches if a replication connection is requested (note that
replication connections do not specify any particular database).
--
GitLab