Message-ID: <19f87c6646f3acbf092ae2cea51beb2f0ae4c492.camel@cybertec.at>
Subject: Re: Certificate Authentication method question about mapping
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Blake Rich <blaric@gmail.com>, pgsql-admin@lists.postgresql.org
Date: Thu, 28 Sep 2023 08:10:08 +0200
In-Reply-To: 
 <CANwurDtf3-UtLA=pRSMMiwjMjDgLVPk1S8FRZqLyJfWnxQ2sMQ@mail.gmail.com>
References: 
	<CANwurDtf3-UtLA=pRSMMiwjMjDgLVPk1S8FRZqLyJfWnxQ2sMQ@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.48.4 (3.48.4-1.fc38) 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/19f87c6646f3acbf092ae2cea51beb2f0ae4c492.camel%40cybertec.at>
Precedence: bulk

On Wed, 2023-09-27 at 20:34 -0600, Blake Rich wrote:
> Recently our CA updated their S/MIME certificates.=C2=A0 We've used them =
for both email as well as certificate authentication with mapping in postgr=
esql. =C2=A0 However our options for certificates ended up
> shifting to an Organization certificate, where the person's name is no lo=
nger the CN of the cert, but rather the CN is the Organization's name.=C2=
=A0 Is there any way with certificate mapping to use a
> field other than CN to map to a database user?=C2=A0 I've searched the ar=
chives and online and can't find any details indicating any way to do so, b=
ut I'm hopeful.=C2=A0=20
>=20
> Old certs that worked to filter out the first name as the username had
>=20
> CN =3D firstname lastname
> E =3D firstname.lastname@<org>.<com>
>=20
> New certs have=C2=A0
>=20
>=20
> CN =3D <org name>
> E =3D firstname.lastname@<org>.<com>
>=20
> I can't seem to figure out how to look at the E =3D field or even if it i=
s possible.=C2=A0 Any insight would be greatly appreciated.

I don't think that's possible, short of modifying PostgreSQL.

Yours,
Laurenz Albe