pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedCertificate Authentication method question about mapping
2+ messages / 2 participants
[nested] [flat]
* Certificate Authentication method question about mapping
@ 2023-09-28 02:34 Blake Rich <blaric@gmail.com>
0 siblings, 1 reply; 2+ messages in thread
From: Blake Rich @ 2023-09-28 02:34 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org
Recently our CA updated their S/MIME certificates. We've used them for
both email as well as certificate authentication with mapping in
postgresql. However our options for certificates ended up shifting to an
Organization certificate, where the person's name is no longer the CN of
the cert, but rather the CN is the Organization's name. Is there any way
with certificate mapping to use a field other than CN to map to a database
user? I've searched the archives and online and can't find any details
indicating any way to do so, but I'm hopeful.
Old certs that worked to filter out the first name as the username had
CN = firstname lastname
E = firstname.lastname@<org>.<com>
New certs have
CN = <org name>
E = firstname.lastname@<org>.<com>
I can't seem to figure out how to look at the E = field or even if it is
possible. Any insight would be greatly appreciated.
Thanks!
Blake
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: Certificate Authentication method question about mapping
@ 2023-09-28 06:10 Laurenz Albe <laurenz.albe@cybertec.at>
parent: Blake Rich <blaric@gmail.com>
0 siblings, 0 replies; 2+ messages in thread
From: Laurenz Albe @ 2023-09-28 06:10 UTC (permalink / raw)
To: Blake Rich <blaric@gmail.com>; pgsql-admin@lists.postgresql.org
On Wed, 2023-09-27 at 20:34 -0600, Blake Rich wrote:
> Recently our CA updated their S/MIME certificates. We've used them for both email as well as certificate authentication with mapping in postgresql. However our options for certificates ended up
> shifting to an Organization certificate, where the person's name is no longer the CN of the cert, but rather the CN is the Organization's name. Is there any way with certificate mapping to use a
> field other than CN to map to a database user? I've searched the archives and online and can't find any details indicating any way to do so, but I'm hopeful.
>
> Old certs that worked to filter out the first name as the username had
>
> CN = firstname lastname
> E = firstname.lastname@<org>.<com>
>
> New certs have
>
>
> CN = <org name>
> E = firstname.lastname@<org>.<com>
>
> I can't seem to figure out how to look at the E = field or even if it is possible. Any insight would be greatly appreciated.
I don't think that's possible, short of modifying PostgreSQL.
Yours,
Laurenz Albe
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2023-09-28 06:10 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2023-09-28 02:34 Certificate Authentication method question about mapping Blake Rich <blaric@gmail.com>
2023-09-28 06:10 ` Laurenz Albe <laurenz.albe@cybertec.at>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox