Superuser Login required when using an Authentication Configuration

[webrian]

Is there a specific reason why a superuser login is required when using an authentication configuration?

When using a user name and password in Basic Authentication, however, no superuser login is required.

[signedav]

In case you have a normal login (without superuser) defined in a generally named authentication (maybe something others have as well) and then you create the schema and you need superuser login for that, then you could edit your own authentication file, yes, but it would be easier to keep it untouched and just create it with the superuser settings from the Model Baker settings. Or do I understand it wrong?

[webrian]

No, this is about the data export workflow.

Suppose I connect to the database with a user with read permission (SELECT privileges) only.

Case A:
I connect to the database using an authentication configuration (in Configuration tab):

The wizard forces me to check Execute data management tasks with superuser login from settings (postgres), but 1. as a "normal" user I do not have superuser access to our production database 2. (and more important) it should not be necessary for an export, as no table or schema is changed. Thus no export can be done.

Whereas case B:
I connect to the database using Basic auth with username and password (in Basic tab):

There is no need to check Execute ... with superuser login ... and it works anyway as expected:

I don't see any reason why a superuser login is required when using the authentication configuration, but not when entering username and password. On our production database only a few users have more than read privileges on certain selected schemas.

[signedav]

Ah now I get it. I haven't seen the message below and assumed you want to ask, why there is the option to use superuser...

Well:

1. yes, on export this option could be hidden, but this is not your issue here anyway.

2. Why it requires superuser login on authentication configuration I don't know. I'll have to check that...

[signedav]

(not sure if it's a bug, but I added it to have it on the list)