From: | Bruce Momjian <bruce(at)momjian(dot)us> |
---|---|
To: | Justin Pryzby <pryzby(at)telsasoft(dot)com> |
Cc: | pgsql-hackers(at)postgresql(dot)org, Andrew Dunstan <andrew(at)dunslane(dot)net> |
Subject: | Re: PG 14 release notes, first draft |
Date: | 2021-05-12 17:25:30 |
Message-ID: | 20210512172530.GK6088@momjian.us |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Wed, May 12, 2021 at 10:06:05AM -0500, Justin Pryzby wrote:
> On Tue, May 11, 2021 at 10:45:04PM -0400, Bruce Momjian wrote:
> > OK, so this is where I am confused. I searched for distinguished name
> > (DN) and came up with DN being a concatentation of all the fields
> > provided to the certificate signing request (CSR). Is that right?
> > Wouldn't people test _parts_ of the DN, rather than all of it.
>
> +Andrew
>
> The full DN is probably not the postgres username, so the docs suggest that:
> | This option is probably best used in conjunction with a username map.
>
> You're right that clientname=DN allows testing *parts*, of the DN, but I don't
> know if there's any reason to believe that's the typical use case.
>
> The primary utility of clientname=DN seems to be that the CN alone is (or can
> be) ambiguous - matching on the full DN is intended to resolve that. I think
> the release notes should focus on this.
OK, that matches what I thought. Here is my updated version:
<listitem>
<!--
Author: Andrew Dunstan <andrew(at)dunslane(dot)net>
2021-03-29 [6d7a6feac] Allow matching the DN of a client certificate for
authen
-->
<para>
Allow the certificate's distinguished name (DN) to be matched for client
certificate authentication (Andrew Dunstan)
</para>
<para>
--> The new pg_hba.conf keyword "clientname=DN" allows comparison with
--> certificate attributes beyond the CN and can be combined with ident
--> maps.
</para>
</listitem>
Technically these are attributes of the certificate signing request
(CSR), but I didn't want to mention that here.
--
Bruce Momjian <bruce(at)momjian(dot)us> https://momjian.us
EDB https://enterprisedb.com
If only the physical world exists, free will is an illusion.
From | Date | Subject | |
---|---|---|---|
Next Message | Zhihong Yu | 2021-05-12 17:27:01 | naming of async_mode parameter |
Previous Message | Bruce Momjian | 2021-05-12 17:14:09 | Re: PG 14 release notes, first draft |