From: Tom Lane <tgl@sss.pgh.pa.us>
To: Laurenz Albe <laurenz.albe@cybertec.at>
cc: Dhirendra Singh <dhirendraks@gmail.com>, pgsql-admin@lists.postgresql.org
Subject: Re: Question about cert authentication method.
In-reply-to: <d0f723304b3b43cc4093d876b43f58cdca34d89d.camel@cybertec.at>
References: 
 <CAEyh4sZ3pSdpFFCR1x8gLDsrB3SbPHG2WarB+uJR75ZUOiR3dg@mail.gmail.com>
 <d0f723304b3b43cc4093d876b43f58cdca34d89d.camel@cybertec.at>
Comments: In-reply-to Laurenz Albe <laurenz.albe@cybertec.at>
	message dated "Fri, 25 Nov 2022 12:54:20 +0100"
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-ID: <4056952.1669391306.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Fri, 25 Nov 2022 10:48:26 -0500
Message-ID: <4056953.1669391306@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/4056953.1669391306%40sss.pgh.pa.us>
Precedence: bulk

Laurenz Albe <laurenz.albe@cybertec.at> writes:
> On Fri, 2022-11-25 at 15:36 +0530, Dhirendra Singh wrote:
>> I am expecting the connection to fail because user "test (S114546) does=
 not exist. but i am confused about the error message in the server log.
>> It says certificate authentication failed=C2=A0 for user "test (S114546=
)". but CN in the certificate matches with the user name in psql connectio=
n request.
>> So certificate authentication should pass. It should fail afterwards.

> Well, "test" is different from "test (S114546)", so what do you expect?

I think the OP is complaining about the message contents, not the
fact of the failure.  However, it's intentional that the message sent
to the client is vague about the exact cause of an authentication
failure.  Otherwise we might be giving aid to a blackhat trying to
break into the server.  The postmaster log is supposed to be more
specific, and it looks to me like what's in the log is accurate.

			regards, tom lane