Re: On login trigger: take three

From: Daniel Gustafsson <daniel(at)yesql(dot)se>
To: Greg Nancarrow <gregn4422(at)gmail(dot)com>
Cc: Teodor Sigaev <teodor(at)sigaev(dot)ru>, Ibrar Ahmed <ibrar(dot)ahmad(at)gmail(dot)com>, Konstantin Knizhnik <k(dot)knizhnik(at)postgrespro(dot)ru>, vignesh C <vignesh21(at)gmail(dot)com>, Ivan Panchenko <wao(at)mail(dot)ru>, Pavel Stehule <pavel(dot)stehule(at)gmail(dot)com>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org>, Amit Kapila <amit(dot)kapila16(at)gmail(dot)com>, Masahiko Sawada <sawada(dot)mshk(at)gmail(dot)com>
Subject: Re: On login trigger: take three
Date: 2021-09-30 09:06:51
Message-ID: 32B082C9-F7DE-4832-9E7F-25975FF3068A@yesql.se
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

> On 30 Sep 2021, at 04:15, Greg Nancarrow <gregn4422(at)gmail(dot)com> wrote:
>
> On Wed, Sep 29, 2021 at 10:14 PM Teodor Sigaev <teodor(at)sigaev(dot)ru> wrote:
>>
>> Nice feature, but, sorry, I see some design problem in suggested feature. AFAIK,
>> there is two use cases for this feature:
>> 1 A permission / prohibition to login some users
>> 2 Just a logging of facts of user's login
>>
>> Suggested patch proposes prohibition of login only by failing of login trigger
>> and it has at least two issues:
>> 1 In case of prohibition to login, there is no clean way to store information
>> about unsuccessful login. Ok, it could be solved by dblink module but it seems
>> to scary.
>
> It's an area that could be improved, but the patch is more intended to
> allow additional actions on successful login, as described by the
> following (taken from the doc updates in the patch):
>
> + <para>
> + The event trigger on the <literal>login</literal> event can be
> + useful for logging user logins, for verifying the connection and
> + assigning roles according to current circumstances, or for some
> session data
> + initialization.
> + </para>

Running user code with potential side effects on unsuccessful logins also open
up the risk for (D)DoS attacks.

--
Daniel Gustafsson https://vmware.com/

In response to

Browse pgsql-hackers by date

  From Date Subject
Next Message Thomas Munro 2021-09-30 09:31:03 Re: rand48 replacement
Previous Message Fabien COELHO 2021-09-30 08:23:00 Re: rand48 replacement