From: Tilman Koschnick <til+pg@subnetz.org>
To: pgsql-admin@lists.postgresql.org
Subject: Re: applicable mapping for clientcert=verify-full
Date: Fri, 12 Mar 2021 09:59:38 +0100
Message-ID: <23f8e02c904b1101fbcc1b91a9b299e5367f663b.camel@subnetz.org> (raw)
In-Reply-To: <f4677bbd8f990c53739043b8feabc69162540e64.camel@subnetz.org>
References: <f4677bbd8f990c53739043b8feabc69162540e64.camel@subnetz.org>
On Do, 2021-03-11 at 21:06 +0100, Tilman Koschnick wrote:
> How do I specify the applicable mapping in that case?
I've dug in a bit further. Since the clientcert option is allowed for
all auth methods, I worked on the assumption that the map option should
also be accepted for all methods, and removed the corresponding check:
inline patch 1: postgresql-13-13.2/src/backend/libpq/hba.c (+0/-6 lines) download inline-1.patch--- postgresql-13-13.2.orig/src/backend/libpq/hba.c+++ postgresql-13-13.2/src/backend/libpq/hba.c@@ -1678,12 +1678,6 @@ parse_hba_auth_opt(char *name, char *val
if (strcmp(name, "map") == 0)
{
- if (hbaline->auth_method != uaIdent &&- hbaline->auth_method != uaPeer &&- hbaline->auth_method != uaGSS &&- hbaline->auth_method != uaSSPI &&- hbaline->auth_method != uaCert)- INVALID_AUTH_OPTION("map", gettext_noop("ident, peer, gssapi, sspi, and cert"));
hbaline->usermap = pstrdup(val);
}
else if (strcmp(name, "clientcert") == 0)
With this change in place, the mapping works for me, with apparently no
ill effects. The build is passing all tests as well.
Should I report this as a bug?
Regards, Til
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: til+pg@subnetz.org, pgsql-admin@lists.postgresql.org
Subject: Re: applicable mapping for clientcert=verify-full
In-Reply-To: <23f8e02c904b1101fbcc1b91a9b299e5367f663b.camel@subnetz.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox