Re: PAM LDAP CREATE USER

Aaron_Wright(at)selinc(dot)com writes:
> I recently upgraded from 8.4 to 9.3, and my custom LDAP PAM module no
> longer works.

8.4.what and 9.3.what? Have you checked the behavior in any other releases?

> In brief, my LDAP PAM module authenticates a centralized user and then
> creates a matching database user, using a separate super user connection
> to the database, before returning successfully from the PAM module. This
> used to work beautifully, but now I get a FATAL error, "role %s does not
> exist".

That seems mighty Rube Goldbergian ... but it's not clear why it used to
work and doesn't anymore. If you'd said 9.4 I'd have guessed at a corner
case in catalog snapshot invalidation, but I think 9.3 would just be
looking for the role with SnapshotNow, which should pretty much always
work. (You're sure the transaction in the background is getting committed
in time, right? And it's being sent to the 9.3 DB not the 8.4 one?)

Also, just to clarify: this is a PAM auth module that just happens to talk
to some LDAP server behind the scenes, right? If Postgres thinks this is
LDAP auth method then some other possibilities open up --- but AFAICS
we've not touched the PAM code since 8.4.2.

regards, tom lane