[PATCH] Support using "all" for the db user in pg_ident.conf

From: Jelte Fennema <Jelte(dot)Fennema(at)microsoft(dot)com>
To: "pgsql-hackers(at)lists(dot)postgresql(dot)org" <pgsql-hackers(at)lists(dot)postgresql(dot)org>
Subject: [PATCH] Support using "all" for the db user in pg_ident.conf
Date: 2022-12-27 15:54:46
Message-ID: DBBPR83MB050793E2B4B166A5B3EDA512F7ED9@DBBPR83MB0507.EURPRD83.prod.outlook.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

While pg_hba.conf has supported the "all" keyword since a very long
time, pg_ident.conf doesn't have this same functionality. This changes
permission checking in pg_ident.conf to handle "all" differently from
any other value in the database-username column. If "all" is specified
and the system-user matches the identifier, then the user is allowed to
authenticate no matter what user it tries to authenticate as.

This change makes it much easier to have a certain database
administrator peer or cert authentication, that allows connecting as
any user. Without this change you would need to add a line to
pg_ident.conf for every user that is in the database.

In some small sense this is a breaking change if anyone is using "all"
as a user currently and has pg_ident.conf rules for it. This seems
unlikely, since "all" was already handled specially in pg_hb.conf.
Also it can easily be worked around by quoting the all token in
pg_ident.conf. As long as this is called out in the release notes
it seems okay to me. However, if others disagree there would
be the option of changing the token to "pg_all". Since any
pg_ prefixed users are reserved by postgres there can be no user.
For now I used "all" though to stay consistent with pg_hba.conf.

Attachment Content-Type Size
v1-0001-Support-using-all-for-the-db-user-in-pg_ident.con.patch application/octet-stream 9.8 KB

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Isaac Morland 2022-12-27 16:21:28 Re: [PATCH] Support using "all" for the db user in pg_ident.conf
Previous Message Maxim Orlov 2022-12-27 15:35:37 False positive warning in verify_heapam.c with GCC 03