Do not treat a superuser as a member of every role for HBA purposes.

This makes it possible to use reject lines with group roles.

Andrew Dunstan, reviewd by Robert Haas.

diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml
index f6f858d47404f150efa83b5ca3951280a0acd2bd..6493d302c7ff5de359aa213e29155239e0e5efd7 100644 (file)
--- a/doc/src/sgml/client-auth.sgml
+++ b/doc/src/sgml/client-auth.sgml
@@ -210,7 +210,10 @@ hostnossl  <replaceable>database</replaceable>  <replaceable>user</replaceable>
        in <productname>PostgreSQL</>; a <literal>+</> mark really means
        <quote>match any of the roles that are directly or indirectly members
        of this role</>, while a name without a <literal>+</> mark matches
-       only that specific role.)
+       only that specific role.) For this purpose, a superuser is only
+       considered to be a member of a role if they are explicitly a member
+       of the role, directly or indirectly, and not just by virtue of
+       being a superuser.
        Multiple user names can be supplied by separating them with commas.
        A separate file containing user names can be specified by preceding the
        file name with <literal>@</>.

diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index d2a6db1478b5aa38c536a2cc4ffdf223a4608e71..a3036018b4c816e0c9cfb3b330069283bddd175f 100644 (file)
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -442,8 +442,13 @@ is_member(Oid userid, const char *role)
        if (!OidIsValid(roleid))
                return false;                   /* if target role not exist, say "no" */
 
-       /* See if user is directly or indirectly a member of role */
-       return is_member_of_role(userid, roleid);
+       /* 
+        * See if user is directly or indirectly a member of role.
+        * For this purpose, a superuser is not considered to be automatically
+        * a member of the role, so group auth only applies to explicit
+        * membership.
+        */
+       return is_member_of_role_nosuper(userid, roleid);
 }
 
 /*