is identical to
dblink_connect(), except that it will allow non-superusers to connect using any authentication method.
If the remote server selects an authentication method that does not involve a password, then impersonation and subsequent escalation of privileges can occur, because the session will appear to have originated from the user as which the local
server runs. Also, even if the remote server does demand a password, it is possible for the password to be supplied from the server environment, such as a
file belonging to the servers user. This opens not only a risk of impersonation, but the possibility of exposing a password to an untrustworthy remote server. Therefore,
is initially installed with all privileges revoked from
PUBLIC, making it un-callable except by superusers. In some situations it may be appropriate to grant
to specific users who are considered trustworthy, but this should be done with care. It is also recommended that any
file belonging to the servers user
contain any records specifying a wildcard host name.
For further details see