pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedmd5 password authentication does not work when db_user_namespace = on
2+ messages / 2 participants
[nested] [flat]
* md5 password authentication does not work when db_user_namespace = on
@ 2008-06-23 14:13 Sava Chankov <sava.chankov@gmail.com>
2008-08-16 02:48 ` Re: md5 password authentication does not work when db_user_namespace = on Bruce Momjian <bruce@momjian.us>
0 siblings, 1 reply; 2+ messages in thread
From: Sava Chankov @ 2008-06-23 14:13 UTC (permalink / raw)
To: pgsql-admin
Hi,
when I set db_user_namespace = on in postgresql.conf and my pg_hba.conf
contains only the line:
local samerole all password
users can be authenticated (I have created users as username@dbname).
However, when I change pg_hba's METHOD to md5, it doesn't work anymore. I
attach my postgresql.conf.
cheers,
Sava Chankov
Attachments:
postgresql.conf (application/octet-stream, 13.4K) download
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: md5 password authentication does not work when db_user_namespace = on
2008-06-23 14:13 md5 password authentication does not work when db_user_namespace = on Sava Chankov <sava.chankov@gmail.com>
@ 2008-08-16 02:48 ` Bruce Momjian <bruce@momjian.us>
0 siblings, 0 replies; 2+ messages in thread
From: Bruce Momjian @ 2008-08-16 02:48 UTC (permalink / raw)
To: Sava Chankov <sava.chankov@gmail.com>; +Cc: pgsql-admin
Sava Chankov wrote:
> Hi,
> when I set db_user_namespace = on in postgresql.conf and my pg_hba.conf
> contains only the line:
> local samerole all password
> users can be authenticated (I have created users as username@dbname).
> However, when I change pg_hba's METHOD to md5, it doesn't work anymore. I
> attach my postgresql.conf.
This is one of those bug reports where I knew the cause as soon as I
heard it. Let me remind people how db_user_namespace works by adding
the database name to the client-supplied user name:
http://www.postgresql.org/docs/8.3/static/runtime-config-connection.html#RUNTIME-CONFIG-CONNECTION-S...
$ psql -U bruce test
psql (8.4devel)
Type "help" for help.
test=> select current_user;
current_user
--------------
bruce@test
(1 row)
test=> \q
$ psql -U postgres@ test
psql (8.4devel)
Type "help" for help.
test=> select current_user;
current_user
--------------
postgres
(1 row)
The problem is that we use the username as part of the salt when we
store the md5-encrypted password. When the client encrypts the password
it thinks the username is different from what the server thinks is the
username.
I can't think of any clean way to fix this. Perhaps we should just
remove the db_user_namespace feature, or throw an error when MD5
encryption is used.
--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ If your life is a hard drive, Christ can be your backup. +
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2008-08-16 02:48 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2008-06-23 14:13 md5 password authentication does not work when db_user_namespace = on Sava Chankov <sava.chankov@gmail.com>
2008-08-16 02:48 ` Bruce Momjian <bruce@momjian.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox