From: | Jelte Fennema <Jelte(dot)Fennema(at)microsoft(dot)com> |
---|---|
To: | "pgsql-hackers(at)lists(dot)postgresql(dot)org" <pgsql-hackers(at)lists(dot)postgresql(dot)org> |
Subject: | [PATCH] Support using "all" for the db user in pg_ident.conf |
Date: | 2022-12-27 15:54:46 |
Message-ID: | DBBPR83MB050793E2B4B166A5B3EDA512F7ED9@DBBPR83MB0507.EURPRD83.prod.outlook.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
While pg_hba.conf has supported the "all" keyword since a very long
time, pg_ident.conf doesn't have this same functionality. This changes
permission checking in pg_ident.conf to handle "all" differently from
any other value in the database-username column. If "all" is specified
and the system-user matches the identifier, then the user is allowed to
authenticate no matter what user it tries to authenticate as.
This change makes it much easier to have a certain database
administrator peer or cert authentication, that allows connecting as
any user. Without this change you would need to add a line to
pg_ident.conf for every user that is in the database.
In some small sense this is a breaking change if anyone is using "all"
as a user currently and has pg_ident.conf rules for it. This seems
unlikely, since "all" was already handled specially in pg_hb.conf.
Also it can easily be worked around by quoting the all token in
pg_ident.conf. As long as this is called out in the release notes
it seems okay to me. However, if others disagree there would
be the option of changing the token to "pg_all". Since any
pg_ prefixed users are reserved by postgres there can be no user.
For now I used "all" though to stay consistent with pg_hba.conf.
Attachment | Content-Type | Size |
---|---|---|
v1-0001-Support-using-all-for-the-db-user-in-pg_ident.con.patch | application/octet-stream | 9.8 KB |
From | Date | Subject | |
---|---|---|---|
Next Message | Isaac Morland | 2022-12-27 16:21:28 | Re: [PATCH] Support using "all" for the db user in pg_ident.conf |
Previous Message | Maxim Orlov | 2022-12-27 15:35:37 | False positive warning in verify_heapam.c with GCC 03 |