From: Holger Jakobs <holger@jakobs.com>
To: pgsql-admin@lists.postgresql.org
Subject: Re: Question about cert authentication method.
Date: Sun, 27 Nov 2022 09:47:57 +0100
Message-ID: <ADCAEEFF-3A7A-4650-B922-E52EB09AFF6F@jakobs.com> (raw)
In-Reply-To: <CAEyh4sbN10dRHfEHgzcPcZj3YALAJ1hkRjidWbQOA4f5SzCSdg@mail.gmail.com>
References: <CAEyh4sZ3pSdpFFCR1x8gLDsrB3SbPHG2WarB+uJR75ZUOiR3dg@mail.gmail.com>
<d0f723304b3b43cc4093d876b43f58cdca34d89d.camel@cybertec.at>
<4056953.1669391306@sss.pgh.pa.us>
<CAEyh4sbN10dRHfEHgzcPcZj3YALAJ1hkRjidWbQOA4f5SzCSdg@mail.gmail.com>
A non-existent user cannot be authenticated.
Am 27. November 2022 06:49:49 MEZ schrieb Dhirendra Singh <dhirendraks@gmail.com>:
>Yes. My question is about the log message.
>Log message in the postmaster says...FATAL: certificate authentication
>failed for user "test (S114546)"
>But certificate authentication should pass because supplied user in the
>connection request and CN in certificate is same.
>It should fail afterwards with message that user "test (S114546)" does not
>exist.
>
>
>Thanks,
>Dhirendra.
>
>On Fri, Nov 25, 2022 at 9:18 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>
>> Laurenz Albe <laurenz.albe@cybertec.at> writes:
>> > On Fri, 2022-11-25 at 15:36 +0530, Dhirendra Singh wrote:
>> >> I am expecting the connection to fail because user "test (S114546) does
>> not exist. but i am confused about the error message in the server log.
>> >> It says certificate authentication failed for user "test (S114546)".
>> but CN in the certificate matches with the user name in psql connection
>> request.
>> >> So certificate authentication should pass. It should fail afterwards.
>>
>> > Well, "test" is different from "test (S114546)", so what do you expect?
>>
>> I think the OP is complaining about the message contents, not the
>> fact of the failure. However, it's intentional that the message sent
>> to the client is vague about the exact cause of an authentication
>> failure. Otherwise we might be giving aid to a blackhat trying to
>> break into the server. The postmaster log is supposed to be more
>> specific, and it looks to me like what's in the log is accurate.
>>
>> regards, tom lane
>>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: holger@jakobs.com, pgsql-admin@lists.postgresql.org
Subject: Re: Question about cert authentication method.
In-Reply-To: <ADCAEEFF-3A7A-4650-B922-E52EB09AFF6F@jakobs.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox