Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1ozDKY-0000hT-Rm for pgsql-admin@arkaria.postgresql.org; Sun, 27 Nov 2022 08:48:06 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1ozDKW-00014s-0P for pgsql-admin@arkaria.postgresql.org; Sun, 27 Nov 2022 08:48:04 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1ozDKV-00014i-ML for pgsql-admin@lists.postgresql.org; Sun, 27 Nov 2022 08:48:03 +0000 Received: from jakobs.com ([85.214.83.89] helo=rs.plausibolo.de) by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1ozDKS-0006W2-TD for pgsql-admin@lists.postgresql.org; Sun, 27 Nov 2022 08:48:02 +0000 Received: from localhost (localhost [127.0.0.1]) by rs.plausibolo.de (Postfix) with ESMTP id 59444380EB7 for ; Sun, 27 Nov 2022 09:47:59 +0100 (CET) Received: from rs.plausibolo.de ([IPv6:::1]) by localhost (h2367442.stratoserver.net [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id oMBYQegs5bay for ; Sun, 27 Nov 2022 09:47:59 +0100 (CET) Received: from [127.0.0.1] (ip-109-42-178-148.web.vodafone.de [109.42.178.148]) by rs.plausibolo.de (Postfix) with ESMTPSA id 118F13806D2 for ; Sun, 27 Nov 2022 09:47:58 +0100 (CET) Date: Sun, 27 Nov 2022 09:47:57 +0100 From: Holger Jakobs To: pgsql-admin@lists.postgresql.org Subject: Re: Question about cert authentication method. User-Agent: K-9 Mail for Android In-Reply-To: References: <4056953.1669391306@sss.pgh.pa.us> Message-ID: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=----JDZ2D5TAG5G2F4H3DUMZN689UNQPWL Content-Transfer-Encoding: 7bit List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk ------JDZ2D5TAG5G2F4H3DUMZN689UNQPWL Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable A non-existent user cannot be authenticated=2E Am 27=2E November 2022 06:49:49 MEZ schrieb Dhirendra Singh : >Yes=2E My question is about the log message=2E >Log message in the postmaster says=2E=2E=2EFATAL: certificate authenticat= ion >failed for user "test (S114546)" >But certificate authentication should pass because supplied user in the >connection request and CN in certificate is same=2E >It should fail afterwards with message that user "test (S114546)" does no= t >exist=2E > > >Thanks, >Dhirendra=2E > >On Fri, Nov 25, 2022 at 9:18 PM Tom Lane wrote: > >> Laurenz Albe writes: >> > On Fri, 2022-11-25 at 15:36 +0530, Dhirendra Singh wrote: >> >> I am expecting the connection to fail because user "test (S114546) d= oes >> not exist=2E but i am confused about the error message in the server lo= g=2E >> >> It says certificate authentication failed for user "test (S114546)"= =2E >> but CN in the certificate matches with the user name in psql connection >> request=2E >> >> So certificate authentication should pass=2E It should fail afterwar= ds=2E >> >> > Well, "test" is different from "test (S114546)", so what do you expec= t? >> >> I think the OP is complaining about the message contents, not the >> fact of the failure=2E However, it's intentional that the message sent >> to the client is vague about the exact cause of an authentication >> failure=2E Otherwise we might be giving aid to a blackhat trying to >> break into the server=2E The postmaster log is supposed to be more >> specific, and it looks to me like what's in the log is accurate=2E >> >> regards, tom lane >> ------JDZ2D5TAG5G2F4H3DUMZN689UNQPWL Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable A non-existent user cannot be authenticated=2E
=
Am 27=2E November 2022 06:49:49 MEZ schrieb = Dhirendra Singh <dhirendraks@gmail=2Ecom>:
Yes=2E= My question is about the log message=2E 
Log message in the postm= aster says=2E=2E=2EFATAL: certificate authentication failed for user "test = (S114546)"
But certificate authentication should pass because sup= plied user in the connection request and CN in certificate is same=2E
=
It should fail afterwards with message that user "test (S114546)"= does not exist=2E


Thanks,
Dhirendra=2E

=
On Fri, Nov 25, 2022 at 9:18 PM Tom L= ane <tgl@sss=2Epgh=2Epa=2Eus<= /a>> wrote:
Laurenz Albe <laurenz=2Ealbe@cybertec=2Eat> writes:
> On Fri, 2022-11-25 at 15:36 +0530, Dhirendra Singh wrote:
>> I am expecting the connection to fail because user "test (S114546= ) does not exist=2E but i am confused about the error message in the server= log=2E
>> It says certificate authentication failed  for user "test (S= 114546)"=2E but CN in the certificate matches with the user name in psql co= nnection request=2E
>> So certificate authentication should pass=2E It should fail after= wards=2E

> Well, "test" is different from "test (S114546)", so what do you expec= t?

I think the OP is complaining about the message contents, not the
fact of the failure=2E  However, it's intentional that the message se= nt
to the client is vague about the exact cause of an authentication
failure=2E  Otherwise we might be giving aid to a blackhat trying to<= br> break into the server=2E  The postmaster log is supposed to be more specific, and it looks to me like what's in the log is accurate=2E

                    &nbs= p;   regards, tom lane
------JDZ2D5TAG5G2F4H3DUMZN689UNQPWL--