pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedsetting up pg_ident for peer auth with unix groups
3+ messages / 3 participants
[nested] [flat]
* setting up pg_ident for peer auth with unix groups
@ 2020-01-30 11:59 Geoff Winkless <pgsqladmin@geoff.dj>
0 siblings, 2 replies; 3+ messages in thread
From: Geoff Winkless @ 2020-01-30 11:59 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org
Hi
Not sure if I'm missing something obvious but I can't see a way to set up
pg_ident with unix groups in the username maps.
https://www.postgresql.org/docs/12/auth-username-maps.html
Is it possible or do I have to set up one entry for every user?
Ta
Geoff
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: setting up pg_ident for peer auth with unix groups
@ 2020-01-30 12:08 Holger Jakobs <holger@jakobs.com>
parent: Geoff Winkless <pgsqladmin@geoff.dj>
1 sibling, 0 replies; 3+ messages in thread
From: Holger Jakobs @ 2020-01-30 12:08 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org
Hi Geoff,
No, there is no such mechanism. The ident service (it's not safe as you
probably know) only delivers the name of the user who has initiated the
TCP connection to the PG server.
This will be matched to the PG user the connection is supposed to be
established as. If they match, the respective line of pg_hba.conf might
grant access.
pg_ident.conf can be used to match system usernames (of the client
machine) to PG usernames.
The /etc/group file which technically could be accessed by PG processes
resides on the server and thus could be very different from the one on
the client machine. Plus, the system username used on the client machine
may not even exist on the server, nor does the PG username have to exist
as a system username on client or server.
Therefore, using Unix groups wouldn't make much sense.
Regards,
Holger
Am 30.01.20 um 12:59 schrieb Geoff Winkless:
> Hi
>
> Not sure if I'm missing something obvious but I can't see a way to set
> up pg_ident with unix groups in the username maps.
>
> https://www.postgresql.org/docs/12/auth-username-maps.html
>
> Is it possible or do I have to set up one entry for every user?
>
> Ta
>
> Geoff
--
Holger Jakobs, Bergisch Gladbach
instant messaging: xmpp:holger@jakobs.com
+49 178 9759012 <tel:+491789759012> oder +49 2202 817157 <tel:+492202817157>
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: setting up pg_ident for peer auth with unix groups
@ 2020-01-30 16:15 Tom Lane <tgl@sss.pgh.pa.us>
parent: Geoff Winkless <pgsqladmin@geoff.dj>
1 sibling, 0 replies; 3+ messages in thread
From: Tom Lane @ 2020-01-30 16:15 UTC (permalink / raw)
To: Geoff Winkless <pgsqladmin@geoff.dj>; +Cc: pgsql-admin@lists.postgresql.org
Geoff Winkless <pgsqladmin@geoff.dj> writes:
> Not sure if I'm missing something obvious but I can't see a way to set up
> pg_ident with unix groups in the username maps.
> https://www.postgresql.org/docs/12/auth-username-maps.html
> Is it possible or do I have to set up one entry for every user?
If your goal is "allow any local user who is a member of group X
to connect", you might be able to do it by setting restrictive
filesystem privileges on the postmaster's Unix-socket file. This
has some disadvantages --- notably, there's no way to override and
let selected non-group-members in too --- but it's worth considering.
See the unix_socket_group and unix_socket_permissions GUCs.
regards, tom lane
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2020-01-30 16:15 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2020-01-30 11:59 setting up pg_ident for peer auth with unix groups Geoff Winkless <pgsqladmin@geoff.dj>
2020-01-30 12:08 ` Holger Jakobs <holger@jakobs.com>
2020-01-30 16:15 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox