The problem to solve here is how to separate access to a CockroachDB service (eg CC) so that only the DBAs have access to the SQL admin role (including root) and end-users cannot use admin at all. This is important for security, to minimize the chance of escalation of privileges.

To achieve this we want to have at least two different SQL TCP ports (this issue thus depends on resolution of #44842). Then a flag to say that one of these TCP listeners does not accept/support admin sessions.

The way it would look like is a flag in the listener. The flag would be passed to the pgwire.Server. Then we'd have two checks:

• during authentication; if the listener does not accept admin sessions then we would reject the connection attempt immediately without even checking the credentials. This is necessary so that an attacker using the public-facing port cannot discover admin credentials.

• during SQL execution; every time there's a role check, the role retrieval logic would dismiss the admin role if it is observed to be inherited by the current SQL user. The idea here is to block the admin-level privileges that could be granted accidentally to the user after the session is already open.

cc @solongordon @thtruo @aaron-crl for tracking.

Jira issue: CRDB-4046