Received: from maia.hub.org (maia-5.hub.org [200.46.204.29])
	by mail.postgresql.org (Postfix) with ESMTP id C97D1B5DBD6
	for <pgsql-admin-postgresql.org@mail.postgresql.org>;
	Wed, 27 Jul 2011 13:32:08 -0300 (ADT)
Received: from mail.postgresql.org ([200.46.204.86])
	by maia.hub.org (mx1.hub.org [200.46.204.29]) (amavisd-maia, port 10024)
	with ESMTP id 82405-02 for
	<pgsql-admin-postgresql.org@mail.postgresql.org>;
	Wed, 27 Jul 2011 16:32:02 +0000 (UTC)
X-Greylist: from auto-whitelisted by SQLgrey-1.7.6
Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130])
	by mail.postgresql.org (Postfix) with ESMTP id 74C46B5D80A
	for <pgsql-admin@postgresql.org>; Wed, 27 Jul 2011 13:32:02 -0300 (ADT)
Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1])
	by sss.pgh.pa.us (8.14.2/8.14.2) with ESMTP id p6RGW17A010639;
	Wed, 27 Jul 2011 12:32:01 -0400 (EDT)
To: Glyn Astill <glynastill@yahoo.co.uk>
cc: "pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
Subject: Re: Adding line to pg_hba.conf for a specific group makes superuser
	authentication fail in 9.0?
In-reply-to: <1311784043.24356.YahooMailNeo@web26002.mail.ukl.yahoo.com> 
References: <1311784043.24356.YahooMailNeo@web26002.mail.ukl.yahoo.com>
Comments: In-reply-to Glyn Astill <glynastill@yahoo.co.uk>
	message dated "Wed, 27 Jul 2011 17:27:23 +0100"
Date: Wed, 27 Jul 2011 12:32:01 -0400
Message-ID: <10638.1311784321@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Spam-Status: No, hits=-3.093 tagged_above=-10 required=5
	tests=BAYES_00=-1.9, RP_MATCHES_RCVD=-1.193
X-Spam-Level: 
X-Archive-Number: 201107/192
X-Sequence-Number: 37971

Glyn Astill <glynastill@yahoo.co.uk> writes:
> I'm having what's hopefully a fairly trivial issue here with pg_hba.conf in 9.0.4; when I add in the following line

>         host    all         +ad_users   10.10.0.0/16          ldap <ldap details>

> If I try to log in with a superuser account from the 10.10.0.0/16 network it appears to try to authenticate it against that entry via ldap.

> This didn't happen in 8.4.8, what could I be missing?

Well, a superuser is automatically considered a member of any group,
so a match to that line would be expected IMO.  If you don't want that,
you need some more-specific line ahead of it to catch superusers.

			regards, tom lane