Re: Can we stop defaulting to 'ident'?

On Fri, 20 Dec 2019 at 01:32, Stephen Frost <sfrost(at)snowman(dot)net> wrote:

> Greetings,
>
> * James Cassell (fedoraproject(at)cyberpear(dot)com) wrote:
> > Peer does not work with TCP connections, and I haven't figured how to
> get,e.g., third-party Java applications working without TCP.
>
> The entire point of peer was to segregate the very insecure 'ident' from
> the actually quite secure 'peer' auth, so, no, it's not going to work
> over TCP connections- that's more-or-less the point.
>
> Regarding a JDBC connection, you can pass in a "socketFactory", as I
> understand it (though I'm no JDBC expert, I'd suggest you address issues
> you have with that to the JDBC list):
>
> https://jdbc.postgresql.org/documentation/head/connect.html
>

Right. PgJDBC doesn't actually have to support it directly, since you can
pass your own socketFactory, such as one provided by
https://github.com/kohlschutter/junixsocket or
https://github.com/jnr/jnr-unixsocket .

As the Java Language specification does not provide for UNIX socket support
and no widely used JVM bundles AF_UNIX socket support there's no way for
PgJDBC to directly support unix sockets. We could add support for it in
jdbc:postgresql:// URLs, but we'd have to do a runtime search of the
classpath to find a suitable SocketFactory using a list of known unix
socket library implementations ... so why bother? If the user has to
install a 3rd party library to do it anyway, they can specify a JDBC URL
argument too.

So PgJDBC already has everything it needs there IMO, except perhaps a hint
in the documentation. Patches welcome :)

--
Craig Ringer http://www.2ndQuadrant.com/
2ndQuadrant - PostgreSQL Solutions for the Enterprise