pg.ddx.io  pgsql-admin@postgresql.org mailing list archive  

help / color / mirror / Atom feed

applicable mapping for clientcert=verify-full
2+ messages / 1 participants
[nested] [flat]

* applicable mapping for clientcert=verify-full
@ 2021-03-11 20:06  Tilman Koschnick <til+pg@subnetz.org>
  0 siblings, 1 reply; 2+ messages in thread

From: Tilman Koschnick @ 2021-03-11 20:06 UTC (permalink / raw)
  To: pgsql-admin@lists.postgresql.org

Hi,

I'd like to combine password authentication with the clientcert=verify-
full option. According to the documentation, this would enforce that
the "cn ... matches the username or an applicable mapping".

If I try to specify the mapping by setting the map= option, I get the
following error: 

   authentication option "map" is only valid for authentication methods
   ident, peer, gssapi, sspi, and cert

How do I specify the applicable mapping in that case?

Kind regards, Til






^ permalink  raw  reply  [nested|flat] 2+ messages in thread

* Re: applicable mapping for clientcert=verify-full
@ 2021-03-12 08:59  Tilman Koschnick <til+pg@subnetz.org>
  parent: Tilman Koschnick <til+pg@subnetz.org>
  0 siblings, 0 replies; 2+ messages in thread

From: Tilman Koschnick @ 2021-03-12 08:59 UTC (permalink / raw)
  To: pgsql-admin@lists.postgresql.org

On Do, 2021-03-11 at 21:06 +0100, Tilman Koschnick wrote:
> How do I specify the applicable mapping in that case?

I've dug in a bit further. Since the clientcert option is allowed for
all auth methods, I worked on the assumption that the map option should
also be accepted for all methods, and removed the corresponding check:

inline patch 1: postgresql-13-13.2/src/backend/libpq/hba.c (+0/-6 lines) download inline-1.patch
--- postgresql-13-13.2.orig/src/backend/libpq/hba.c
+++ postgresql-13-13.2/src/backend/libpq/hba.c
@@ -1678,12 +1678,6 @@ parse_hba_auth_opt(char *name, char *val
  
        if (strcmp(name, "map") == 0)
        {
-               if (hbaline->auth_method != uaIdent &&
-                       hbaline->auth_method != uaPeer &&
-                       hbaline->auth_method != uaGSS &&
-                       hbaline->auth_method != uaSSPI &&
-                       hbaline->auth_method != uaCert)
-                       INVALID_AUTH_OPTION("map", gettext_noop("ident, peer, gssapi, sspi, and cert"));
                hbaline->usermap = pstrdup(val);
        }
        else if (strcmp(name, "clientcert") == 0)

With this change in place, the mapping works for me, with apparently no
ill effects. The build is passing all tests as well.

Should I report this as a bug?

Regards, Til






^ permalink  raw  reply  [nested|flat] 2+ messages in thread

end of thread, other threads:[~2021-03-12 08:59 UTC | newest]

Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2021-03-11 20:06 applicable mapping for clientcert=verify-full Tilman Koschnick <til+pg@subnetz.org>
2021-03-12 08:59 ` Tilman Koschnick <til+pg@subnetz.org>

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox