id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
34200	Allow setting postgres role during connection setup	Mike Crute	nobody	"When attempting to mutate database objects (tables, enumerations, etc...) Postgres requires that the logged-in role match the owning role for those objects. Typically the owning role of an object is the role that created it. This is a problem when using systems such as [[https://www.hashicorp.com/products/vault|Hashicorp Vault]] which create ephemeral single-use roles for applications since those roles will, by definition, never match the creating/owning role. This results in permission errors during structural changes such as migrations. These errors are of the general form ""sequence must have same owner as table it is linked to"".

The solution to this problem is pretty straightforward. First create a grouping role for the application (roles do not distinguish between being a user or a group) that can become the owner of the database objects. Then create the temporary roles generated by the credential management system as members of this grouping role. Finally, assume that grouping role before performing actions on the database using the [[https://www.postgresql.org/docs/8.4/sql-set-role.html|SET ROLE]] statement during connection setup. This will cause all of the temporary roles to act as the grouping role which has ownership of all of these objects and eliminate the permission issues.

I propose adding a PostgreSQL-specific driver option in the settings called `role` which, if present, will cause the connection setup code to issue the appropriate `SET ROLE` statement at connection creation.

I have a patch for this that I'm testing and will submit soon."	New feature	new	Database layer (models, ORM)	4.1	Normal				Unreviewed	0	0	0	0	0	0