From: Tom Lane <tgl@sss.pgh.pa.us>
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Dhirendra Singh <dhirendraks@gmail.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: Question about cert authentication method.
Date: Fri, 25 Nov 2022 10:48:26 -0500
Message-ID: <4056953.1669391306@sss.pgh.pa.us> (raw)
In-Reply-To: <d0f723304b3b43cc4093d876b43f58cdca34d89d.camel@cybertec.at>
References: <CAEyh4sZ3pSdpFFCR1x8gLDsrB3SbPHG2WarB+uJR75ZUOiR3dg@mail.gmail.com>
<d0f723304b3b43cc4093d876b43f58cdca34d89d.camel@cybertec.at>
Laurenz Albe <laurenz.albe@cybertec.at> writes:
> On Fri, 2022-11-25 at 15:36 +0530, Dhirendra Singh wrote:
>> I am expecting the connection to fail because user "test (S114546) does not exist. but i am confused about the error message in the server log.
>> It says certificate authentication failed for user "test (S114546)". but CN in the certificate matches with the user name in psql connection request.
>> So certificate authentication should pass. It should fail afterwards.
> Well, "test" is different from "test (S114546)", so what do you expect?
I think the OP is complaining about the message contents, not the
fact of the failure. However, it's intentional that the message sent
to the client is vague about the exact cause of an authentication
failure. Otherwise we might be giving aid to a blackhat trying to
break into the server. The postmaster log is supposed to be more
specific, and it looks to me like what's in the log is accurate.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, laurenz.albe@cybertec.at, dhirendraks@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: Question about cert authentication method.
In-Reply-To: <4056953.1669391306@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox