From: Bruce Momjian <bruce@momjian.us>
To: Craig Perras <cperras@u.washington.edu>
Cc: pgsql-admin@postgresql.org
Subject: Re: ssl-info, enforcing list of common-names
Date: Wed, 7 Jan 2009 22:19:38 -0500 (EST)
Message-ID: <200901080319.n083Jc214094@momjian.us> (raw)
In-Reply-To: <Pine.LNX.4.64.0810011006340.19163@homer24.u.washington.edu>
Would someone please reply this question.
---------------------------------------------------------------------------
Craig Perras wrote:
> Hi -
>
> A couple things. I noticed that these two functions return NULL (or empty
> string):
>
> select ssl_issuer_dn();
> select ssl_client_dn();
>
> However, I can get specific fields:
>
> select '/CN=' || ssl_issuer_field('commonName')
> || '/C=' || ssl_issuer_field('countryName')
> || '/O=' || ssl_issuer_field('organizationName')
> ;
>
> --returns "/CN=UW Services CA/C=US/O=University of Washington"
>
> I'm thinking of using an authorization scheme in which I check a list of
> valid certificate common-names, and, if the current client has no cert or
> is not in the list, they have no access (maybe force a logout). Is this
> feasable and/or advisable? I'll only have a single trusted CA.
>
> Any help is appreciated!
>
> thanks,
> --craig
>
> --
> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-admin
--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ If your life is a hard drive, Christ can be your backup. +
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: bruce@momjian.us, cperras@u.washington.edu
Subject: Re: ssl-info, enforcing list of common-names
In-Reply-To: <200901080319.n083Jc214094@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox