set_user

set_user

set_user : similar to SET ROLE but with added logging

Overview

IDExtensionPackageVersionCategoryLicenseLanguage
7370
set_user
set_user
4.2.0
SEC
PostgreSQL
C
AttributeHas BinaryHas LibraryNeed LoadHas DDLRelocatableTrusted
--sLd--
No
Yes
Yes
Yes
no
no
Relationships
See Also
pg_readonly
pg_permissions
pgaudit
login_hook
pgauditlogtofile
pg_auth_mon
credcheck
pgextwlist

Packages

TypeRepoVersionPG Major CompatibilityPackage PatternDependencies
EXT
PGDG
4.2.0
18
17
16
15
14
set_user-
RPM
PGDG
4.2.0
18
17
16
15
14
set_user_$v-
DEB
PGDG
4.2.0
18
17
16
15
14
postgresql-$v-set-user-
Linux / PGPG18PG17PG16PG15PG14
el8.x86_64
PGDG 4.2.0
PGDG 4.1.0
PGDG 4.1.0
PGDG 4.1.0
PGDG 4.1.0
el8.aarch64
PGDG 4.2.0
PGDG 4.1.0
PGDG 4.1.0
PGDG 4.1.0
PGDG 4.1.0
el9.x86_64
PGDG 4.2.0
PGDG 4.1.0
PGDG 4.1.0
PGDG 4.1.0
PGDG 4.1.0
el9.aarch64
PGDG 4.2.0
PGDG 4.1.0
PGDG 4.1.0
PGDG 4.1.0
PGDG 4.1.0
el10.x86_64
PGDG 4.2.0
PGDG 4.1.0
PGDG 4.1.0
PGDG 4.1.0
PGDG 4.1.0
el10.aarch64
PGDG 4.2.0
PGDG 4.1.0
PGDG 4.1.0
PGDG 4.1.0
PGDG 4.1.0
d12.x86_64
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
d12.aarch64
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
d13.x86_64
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
d13.aarch64
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
u22.x86_64
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
u22.aarch64
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
u24.x86_64
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
u24.aarch64
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PGDG 4.2.0
PackageVersionOSORGSIZEFile URL
set_user_164.1.0el8.x86_64pgdg26.4 KiBset_user_16-4.1.0-1PGDG.rhel8.x86_64.rpm
set_user_164.0.1el8.x86_64pgdg26.2 KiBset_user_16-4.0.1-2.rhel8.1.x86_64.rpm
set_user_164.1.0el8.aarch64pgdg26.2 KiBset_user_16-4.1.0-1PGDG.rhel8.aarch64.rpm
set_user_164.0.1el8.aarch64pgdg25.9 KiBset_user_16-4.0.1-2.rhel8.1.aarch64.rpm
set_user_164.1.0el9.x86_64pgdg26.5 KiBset_user_16-4.1.0-1PGDG.rhel9.x86_64.rpm
set_user_164.0.1el9.x86_64pgdg26.3 KiBset_user_16-4.0.1-2.rhel9.1.x86_64.rpm
set_user_164.1.0el9.aarch64pgdg25.9 KiBset_user_16-4.1.0-1PGDG.rhel9.aarch64.rpm
set_user_164.0.1el9.aarch64pgdg25.6 KiBset_user_16-4.0.1-2.rhel9.1.aarch64.rpm
set_user_164.1.0el10.x86_64pgdg26.8 KiBset_user_16-4.1.0-2PGDG.rhel10.x86_64.rpm
set_user_164.1.0el10.aarch64pgdg26.4 KiBset_user_16-4.1.0-2PGDG.rhel10.aarch64.rpm
postgresql-16-set-user4.2.0d12.x86_64pgdg35.0 KiBpostgresql-16-set-user_4.2.0-1.pgdg12+1_amd64.deb
postgresql-16-set-user4.2.0d12.aarch64pgdg34.6 KiBpostgresql-16-set-user_4.2.0-1.pgdg12+1_arm64.deb
postgresql-16-set-user4.2.0d13.x86_64pgdg35.0 KiBpostgresql-16-set-user_4.2.0-1.pgdg13+1_amd64.deb
postgresql-16-set-user4.2.0d13.aarch64pgdg34.6 KiBpostgresql-16-set-user_4.2.0-1.pgdg13+1_arm64.deb
postgresql-16-set-user4.2.0u22.x86_64pgdg38.5 KiBpostgresql-16-set-user_4.2.0-1.pgdg22.04+1_amd64.deb
postgresql-16-set-user4.2.0u22.aarch64pgdg38.1 KiBpostgresql-16-set-user_4.2.0-1.pgdg22.04+1_arm64.deb
postgresql-16-set-user4.2.0u24.x86_64pgdg34.5 KiBpostgresql-16-set-user_4.2.0-1.pgdg24.04+1_amd64.deb
postgresql-16-set-user4.2.0u24.aarch64pgdg34.0 KiBpostgresql-16-set-user_4.2.0-1.pgdg24.04+1_arm64.deb
PackageVersionOSORGSIZEFile URL
set_user_154.1.0el8.x86_64pgdg26.3 KiBset_user_15-4.1.0-1PGDG.rhel8.x86_64.rpm
set_user_154.0.1el8.x86_64pgdg26.0 KiBset_user_15-4.0.1-2.rhel8.x86_64.rpm
set_user_154.0.0el8.x86_64pgdg25.5 KiBset_user_15-4.0.0-1.rhel8.x86_64.rpm
set_user_154.1.0el8.aarch64pgdg26.1 KiBset_user_15-4.1.0-1PGDG.rhel8.aarch64.rpm
set_user_154.0.1el8.aarch64pgdg25.8 KiBset_user_15-4.0.1-2.rhel8.aarch64.rpm
set_user_154.0.0el8.aarch64pgdg25.2 KiBset_user_15-4.0.0-1.rhel8.aarch64.rpm
set_user_154.1.0el9.x86_64pgdg26.4 KiBset_user_15-4.1.0-1PGDG.rhel9.x86_64.rpm
set_user_154.0.1el9.x86_64pgdg26.1 KiBset_user_15-4.0.1-2.rhel9.x86_64.rpm
set_user_154.0.0el9.x86_64pgdg25.8 KiBset_user_15-4.0.0-1.rhel9.x86_64.rpm
set_user_154.1.0el9.aarch64pgdg25.8 KiBset_user_15-4.1.0-1PGDG.rhel9.aarch64.rpm
set_user_154.0.1el9.aarch64pgdg25.4 KiBset_user_15-4.0.1-2.rhel9.aarch64.rpm
set_user_154.0.0el9.aarch64pgdg25.1 KiBset_user_15-4.0.0-1.rhel9.aarch64.rpm
set_user_154.1.0el10.x86_64pgdg26.7 KiBset_user_15-4.1.0-2PGDG.rhel10.x86_64.rpm
set_user_154.1.0el10.aarch64pgdg26.3 KiBset_user_15-4.1.0-2PGDG.rhel10.aarch64.rpm
postgresql-15-set-user4.2.0d12.x86_64pgdg34.6 KiBpostgresql-15-set-user_4.2.0-1.pgdg12+1_amd64.deb
postgresql-15-set-user4.2.0d12.aarch64pgdg34.2 KiBpostgresql-15-set-user_4.2.0-1.pgdg12+1_arm64.deb
postgresql-15-set-user4.2.0d13.x86_64pgdg34.7 KiBpostgresql-15-set-user_4.2.0-1.pgdg13+1_amd64.deb
postgresql-15-set-user4.2.0d13.aarch64pgdg34.3 KiBpostgresql-15-set-user_4.2.0-1.pgdg13+1_arm64.deb
postgresql-15-set-user4.2.0u22.x86_64pgdg38.2 KiBpostgresql-15-set-user_4.2.0-1.pgdg22.04+1_amd64.deb
postgresql-15-set-user4.2.0u22.aarch64pgdg37.8 KiBpostgresql-15-set-user_4.2.0-1.pgdg22.04+1_arm64.deb
postgresql-15-set-user4.2.0u24.x86_64pgdg34.2 KiBpostgresql-15-set-user_4.2.0-1.pgdg24.04+1_amd64.deb
postgresql-15-set-user4.2.0u24.aarch64pgdg33.7 KiBpostgresql-15-set-user_4.2.0-1.pgdg24.04+1_arm64.deb
PackageVersionOSORGSIZEFile URL
set_user_144.1.0el8.x86_64pgdg26.3 KiBset_user_14-4.1.0-1PGDG.rhel8.x86_64.rpm
set_user_144.0.1el8.x86_64pgdg26.0 KiBset_user_14-4.0.1-2.rhel8.x86_64.rpm
set_user_144.0.0el8.x86_64pgdg25.5 KiBset_user_14-4.0.0-1.rhel8.x86_64.rpm
set_user_143.0.0el8.x86_64pgdg25.3 KiBset_user_14-3.0.0-1.rhel8.x86_64.rpm
set_user_144.1.0el8.aarch64pgdg26.1 KiBset_user_14-4.1.0-1PGDG.rhel8.aarch64.rpm
set_user_144.0.1el8.aarch64pgdg25.7 KiBset_user_14-4.0.1-2.rhel8.aarch64.rpm
set_user_144.0.0el8.aarch64pgdg25.2 KiBset_user_14-4.0.0-1.rhel8.aarch64.rpm
set_user_143.0.0el8.aarch64pgdg25.1 KiBset_user_14-3.0.0-1.rhel8.aarch64.rpm
set_user_144.1.0el9.x86_64pgdg26.4 KiBset_user_14-4.1.0-1PGDG.rhel9.x86_64.rpm
set_user_144.0.1el9.x86_64pgdg26.1 KiBset_user_14-4.0.1-2.rhel9.x86_64.rpm
set_user_144.0.0el9.x86_64pgdg25.8 KiBset_user_14-4.0.0-1.rhel9.x86_64.rpm
set_user_144.1.0el9.aarch64pgdg25.8 KiBset_user_14-4.1.0-1PGDG.rhel9.aarch64.rpm
set_user_144.0.1el9.aarch64pgdg25.4 KiBset_user_14-4.0.1-2.rhel9.aarch64.rpm
set_user_144.0.0el9.aarch64pgdg25.1 KiBset_user_14-4.0.0-1.rhel9.aarch64.rpm
set_user_143.0.0el9.aarch64pgdg25.0 KiBset_user_14-3.0.0-1.rhel9.aarch64.rpm
set_user_144.1.0el10.x86_64pgdg26.7 KiBset_user_14-4.1.0-2PGDG.rhel10.x86_64.rpm
set_user_144.1.0el10.aarch64pgdg26.3 KiBset_user_14-4.1.0-2PGDG.rhel10.aarch64.rpm
postgresql-14-set-user4.2.0d12.x86_64pgdg34.7 KiBpostgresql-14-set-user_4.2.0-1.pgdg12+1_amd64.deb
postgresql-14-set-user4.2.0d12.aarch64pgdg34.2 KiBpostgresql-14-set-user_4.2.0-1.pgdg12+1_arm64.deb
postgresql-14-set-user4.2.0d13.x86_64pgdg34.7 KiBpostgresql-14-set-user_4.2.0-1.pgdg13+1_amd64.deb
postgresql-14-set-user4.2.0d13.aarch64pgdg34.2 KiBpostgresql-14-set-user_4.2.0-1.pgdg13+1_arm64.deb
postgresql-14-set-user4.2.0u22.x86_64pgdg38.1 KiBpostgresql-14-set-user_4.2.0-1.pgdg22.04+1_amd64.deb
postgresql-14-set-user4.2.0u22.aarch64pgdg37.8 KiBpostgresql-14-set-user_4.2.0-1.pgdg22.04+1_arm64.deb
postgresql-14-set-user4.2.0u24.x86_64pgdg34.2 KiBpostgresql-14-set-user_4.2.0-1.pgdg24.04+1_amd64.deb
postgresql-14-set-user4.2.0u24.aarch64pgdg33.7 KiBpostgresql-14-set-user_4.2.0-1.pgdg24.04+1_arm64.deb

Source

Install

Make sure PGDG repo available:

pig repo add pgdg -u    # add pgdg repo and update cache

Install this extension with pig:

pig install set_user;		# install via package name, for the active PG version

pig install set_user -v 18;   # install for PG 18
pig install set_user -v 17;   # install for PG 17
pig install set_user -v 16;   # install for PG 16
pig install set_user -v 15;   # install for PG 15
pig install set_user -v 14;   # install for PG 14

Config this extension to shared_preload_libraries:

shared_preload_libraries = 'set_user';

Create this extension with:

CREATE EXTENSION set_user;

Usage

set_user: User switching with enhanced logging and control

set_user allows switching users and optional privilege escalation with enhanced audit logging. It provides an additional layer of control when unprivileged users must escalate to superuser or object owner roles for maintenance tasks.

CREATE EXTENSION set_user;

Configuration

Add to postgresql.conf:

shared_preload_libraries = 'set_user'
ParameterDefaultDescription
set_user.block_alter_systemonBlock ALTER SYSTEM when escalated
set_user.block_copy_programonBlock COPY PROGRAM when escalated
set_user.block_log_statementonBlock SET log_statement; force log_statement=all for superusers
set_user.superuser_allowlist*Roles allowed to escalate to superuser
set_user.nosuperuser_target_allowlist*Roles allowed as non-superuser targets
set_user.superuser_audit_tagAUDITTag appended to log_line_prefix on escalation

Functions

-- Switch to a non-superuser role
SELECT set_user('dbclient');

-- Escalate to superuser (requires EXECUTE on set_user_u)
SELECT set_user_u('postgres');

-- Switch with a token (token required for reset)
SELECT set_user('dbclient', 'my_secret_token');

-- Reset back to original user
SELECT reset_user();
SELECT reset_user('my_secret_token');  -- if token was used

-- Irrevocable session auth switch
SELECT set_session_auth('target_role');

Permission Setup

-- Allow role to switch to non-superuser roles
GRANT EXECUTE ON FUNCTION set_user(text) TO admin;

-- Allow role to escalate to superuser
GRANT EXECUTE ON FUNCTION set_user_u(text) TO dba;

Behavior on Escalation

When escalating to a superuser role:

  • The role transition is logged with a specific notation
  • ALTER SYSTEM and COPY PROGRAM are blocked (if configured)
  • log_statement is forced to all for full audit trail
  • The AUDIT tag is appended to log_line_prefix
Last updated on