pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedQuestion about cert authentication method.
6+ messages / 5 participants
[nested] [flat]
* Question about cert authentication method.
@ 2022-11-25 10:06 Dhirendra Singh <dhirendraks@gmail.com>
0 siblings, 1 reply; 6+ messages in thread
From: Dhirendra Singh @ 2022-11-25 10:06 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org
Hi All,
I have a question about cert authentication method. I am using postgres
version 14.
Following is the entry i have in the pg_hba file.
hostssl all all 0.0.0.0/0 cert map=mymap
Following is the entry in the pg_ident file.
mymap test readonly
trying to connect to the server using psql. CN in the certificate is "test
(S114546)".
psql "host=localhost user='test (S114546)' dbname=appdb sslmode=verify-full
sslcert=certificate.crt sslkey=certificate.key sslrootcert=cacerts"
No mapping exist for "test (S114547)" in the pg_ident file.
The connection failed with following error.
psql: error: connection to server at "localhost", port 5432 failed: FATAL:
certificate authentication failed for user "test (S114546)"
Error in the server log is...
2022-11-25 09:26:52.169 UTC [62] LOG: no match in usermap "mymap" for user
"test (S114546)" authenticated as "test (S114546)"
2022-11-25 09:26:52.169 UTC [62] FATAL: certificate authentication failed
for user "test (S114546)"
2022-11-25 09:26:52.169 UTC [62] DETAIL: Connection matched pg_hba.conf
line 4: "hostssl all all 0.0.0.0/0 cert map=mymap"
I am expecting the connection to fail because user "test (S114546) does not
exist. but i am confused about the error message in the server log.
It says certificate authentication failed for user "test (S114546)". but
CN in the certificate matches with the user name in psql connection request.
So certificate authentication should pass. It should fail afterwards.
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Question about cert authentication method.
@ 2022-11-25 11:54 Laurenz Albe <laurenz.albe@cybertec.at>
parent: Dhirendra Singh <dhirendraks@gmail.com>
0 siblings, 1 reply; 6+ messages in thread
From: Laurenz Albe @ 2022-11-25 11:54 UTC (permalink / raw)
To: Dhirendra Singh <dhirendraks@gmail.com>; pgsql-admin@lists.postgresql.org
On Fri, 2022-11-25 at 15:36 +0530, Dhirendra Singh wrote:
> I have a question about cert authentication method. I am using postgres version 14.
>
> Following is the entry i have in the pg_hba file.
> hostssl all all 0.0.0.0/0 cert map=mymap
>
> Following is the entry in the pg_ident file.
> mymap test readonly
>
> trying to connect to the server using psql. CN in the certificate is "test (S114546)".
> psql "host=localhost user='test (S114546)' dbname=appdb sslmode=verify-full sslcert=certificate.crt sslkey=certificate.key sslrootcert=cacerts"
>
> No mapping exist for "test (S114547)" in the pg_ident file.
>
> The connection failed with following error.
> psql: error: connection to server at "localhost", port 5432 failed: FATAL: certificate authentication failed for user "test (S114546)"
>
> Error in the server log is...
> 2022-11-25 09:26:52.169 UTC [62] LOG: no match in usermap "mymap" for user "test (S114546)" authenticated as "test (S114546)"
> 2022-11-25 09:26:52.169 UTC [62] FATAL: certificate authentication failed for user "test (S114546)"
> 2022-11-25 09:26:52.169 UTC [62] DETAIL: Connection matched pg_hba.conf line 4: "hostssl all all 0.0.0.0/0 cert map=mymap"
>
> I am expecting the connection to fail because user "test (S114546) does not exist. but i am confused about the error message in the server log.
> It says certificate authentication failed for user "test (S114546)". but CN in the certificate matches with the user name in psql connection request.
> So certificate authentication should pass. It should fail afterwards.
Well, "test" is different from "test (S114546)", so what do you expect?
You should use a regular expression in "pg_ident.conf", if you want that to match:
mymap /^test readonly
Yours,
Laurenz Albe,
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Question about cert authentication method.
@ 2022-11-25 15:48 Tom Lane <tgl@sss.pgh.pa.us>
parent: Laurenz Albe <laurenz.albe@cybertec.at>
0 siblings, 1 reply; 6+ messages in thread
From: Tom Lane @ 2022-11-25 15:48 UTC (permalink / raw)
To: Laurenz Albe <laurenz.albe@cybertec.at>; +Cc: Dhirendra Singh <dhirendraks@gmail.com>; pgsql-admin@lists.postgresql.org
Laurenz Albe <laurenz.albe@cybertec.at> writes:
> On Fri, 2022-11-25 at 15:36 +0530, Dhirendra Singh wrote:
>> I am expecting the connection to fail because user "test (S114546) does not exist. but i am confused about the error message in the server log.
>> It says certificate authentication failed for user "test (S114546)". but CN in the certificate matches with the user name in psql connection request.
>> So certificate authentication should pass. It should fail afterwards.
> Well, "test" is different from "test (S114546)", so what do you expect?
I think the OP is complaining about the message contents, not the
fact of the failure. However, it's intentional that the message sent
to the client is vague about the exact cause of an authentication
failure. Otherwise we might be giving aid to a blackhat trying to
break into the server. The postmaster log is supposed to be more
specific, and it looks to me like what's in the log is accurate.
regards, tom lane
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Question about cert authentication method.
@ 2022-11-27 05:49 Dhirendra Singh <dhirendraks@gmail.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 2 replies; 6+ messages in thread
From: Dhirendra Singh @ 2022-11-27 05:49 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Laurenz Albe <laurenz.albe@cybertec.at>; pgsql-admin@lists.postgresql.org
Yes. My question is about the log message.
Log message in the postmaster says...FATAL: certificate authentication
failed for user "test (S114546)"
But certificate authentication should pass because supplied user in the
connection request and CN in certificate is same.
It should fail afterwards with message that user "test (S114546)" does not
exist.
Thanks,
Dhirendra.
On Fri, Nov 25, 2022 at 9:18 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> Laurenz Albe <laurenz.albe@cybertec.at> writes:
> > On Fri, 2022-11-25 at 15:36 +0530, Dhirendra Singh wrote:
> >> I am expecting the connection to fail because user "test (S114546) does
> not exist. but i am confused about the error message in the server log.
> >> It says certificate authentication failed for user "test (S114546)".
> but CN in the certificate matches with the user name in psql connection
> request.
> >> So certificate authentication should pass. It should fail afterwards.
>
> > Well, "test" is different from "test (S114546)", so what do you expect?
>
> I think the OP is complaining about the message contents, not the
> fact of the failure. However, it's intentional that the message sent
> to the client is vague about the exact cause of an authentication
> failure. Otherwise we might be giving aid to a blackhat trying to
> break into the server. The postmaster log is supposed to be more
> specific, and it looks to me like what's in the log is accurate.
>
> regards, tom lane
>
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Question about cert authentication method.
@ 2022-11-27 08:47 Holger Jakobs <holger@jakobs.com>
parent: Dhirendra Singh <dhirendraks@gmail.com>
1 sibling, 0 replies; 6+ messages in thread
From: Holger Jakobs @ 2022-11-27 08:47 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org
A non-existent user cannot be authenticated.
Am 27. November 2022 06:49:49 MEZ schrieb Dhirendra Singh <dhirendraks@gmail.com>:
>Yes. My question is about the log message.
>Log message in the postmaster says...FATAL: certificate authentication
>failed for user "test (S114546)"
>But certificate authentication should pass because supplied user in the
>connection request and CN in certificate is same.
>It should fail afterwards with message that user "test (S114546)" does not
>exist.
>
>
>Thanks,
>Dhirendra.
>
>On Fri, Nov 25, 2022 at 9:18 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>
>> Laurenz Albe <laurenz.albe@cybertec.at> writes:
>> > On Fri, 2022-11-25 at 15:36 +0530, Dhirendra Singh wrote:
>> >> I am expecting the connection to fail because user "test (S114546) does
>> not exist. but i am confused about the error message in the server log.
>> >> It says certificate authentication failed for user "test (S114546)".
>> but CN in the certificate matches with the user name in psql connection
>> request.
>> >> So certificate authentication should pass. It should fail afterwards.
>>
>> > Well, "test" is different from "test (S114546)", so what do you expect?
>>
>> I think the OP is complaining about the message contents, not the
>> fact of the failure. However, it's intentional that the message sent
>> to the client is vague about the exact cause of an authentication
>> failure. Otherwise we might be giving aid to a blackhat trying to
>> break into the server. The postmaster log is supposed to be more
>> specific, and it looks to me like what's in the log is accurate.
>>
>> regards, tom lane
>>
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Question about cert authentication method.
@ 2022-11-27 18:15 Jeff Janes <jeff.janes@gmail.com>
parent: Dhirendra Singh <dhirendraks@gmail.com>
1 sibling, 0 replies; 6+ messages in thread
From: Jeff Janes @ 2022-11-27 18:15 UTC (permalink / raw)
To: Dhirendra Singh <dhirendraks@gmail.com>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; Laurenz Albe <laurenz.albe@cybertec.at>; pgsql-admin@lists.postgresql.org
On Sun, Nov 27, 2022 at 12:50 AM Dhirendra Singh <dhirendraks@gmail.com>
wrote:
> Yes. My question is about the log message.
> Log message in the postmaster says...FATAL: certificate authentication
> failed for user "test (S114546)"
> But certificate authentication should pass because supplied user in the
> connection request and CN in certificate is same.
>
"certificate authentication" is the name for the overall process, and that
overall process did fail. The specific reason for the failure is given in
the server log (but intentionally not passed to the client): 'no match in
usermap "mymap"'.
It should fail afterwards with message that user "test (S114546)" does not
> exist
>
It can't get far enough to fail for that reason, because the usermap
failure squashes it first. If you add a mapping for that non-existent user
(or just stop using a map) then you will get an error about the user not
existing.
Cheers,
Jeff
^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2022-11-27 18:15 UTC | newest]
Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2022-11-25 10:06 Question about cert authentication method. Dhirendra Singh <dhirendraks@gmail.com>
2022-11-25 11:54 ` Laurenz Albe <laurenz.albe@cybertec.at>
2022-11-25 15:48 ` Tom Lane <tgl@sss.pgh.pa.us>
2022-11-27 05:49 ` Dhirendra Singh <dhirendraks@gmail.com>
2022-11-27 08:47 ` Holger Jakobs <holger@jakobs.com>
2022-11-27 18:15 ` Jeff Janes <jeff.janes@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox