Message-ID: <d0f723304b3b43cc4093d876b43f58cdca34d89d.camel@cybertec.at>
Subject: Re: Question about cert authentication method.
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Dhirendra Singh <dhirendraks@gmail.com>, pgsql-admin@lists.postgresql.org
Date: Fri, 25 Nov 2022 12:54:20 +0100
In-Reply-To: 
 <CAEyh4sZ3pSdpFFCR1x8gLDsrB3SbPHG2WarB+uJR75ZUOiR3dg@mail.gmail.com>
References: 
	<CAEyh4sZ3pSdpFFCR1x8gLDsrB3SbPHG2WarB+uJR75ZUOiR3dg@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.42.4 (3.42.4-2.fc35) 
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Archived-At: 
 <https://www.postgresql.org/message-id/d0f723304b3b43cc4093d876b43f58cdca34d89d.camel%40cybertec.at>
Precedence: bulk

On Fri, 2022-11-25 at 15:36 +0530, Dhirendra Singh wrote:
> I have a question about cert authentication method. I am using postgres version 14.
> 
> Following is the entry i have in the pg_hba file.
> hostssl  all  all  0.0.0.0/0   cert map=mymap
> 
> Following is the entry in the pg_ident file.
> mymap  test  readonly
> 
> trying to connect to the server using psql. CN in the certificate is "test (S114546)".
> psql "host=localhost user='test (S114546)' dbname=appdb sslmode=verify-full sslcert=certificate.crt sslkey=certificate.key sslrootcert=cacerts"
> 
> No mapping exist for "test (S114547)" in the pg_ident file.
> 
> The connection failed with following error.
> psql: error: connection to server at "localhost", port 5432 failed: FATAL:  certificate authentication failed for user "test (S114546)"
> 
> Error in the server log is...
> 2022-11-25 09:26:52.169 UTC [62] LOG: no match in usermap "mymap" for user "test (S114546)" authenticated as "test (S114546)"
> 2022-11-25 09:26:52.169 UTC [62] FATAL: certificate authentication failed for user "test (S114546)"
> 2022-11-25 09:26:52.169 UTC [62] DETAIL: Connection matched pg_hba.conf line 4: "hostssl all all 0.0.0.0/0 cert map=mymap"
> 
> I am expecting the connection to fail because user "test (S114546) does not exist. but i am confused about the error message in the server log.
> It says certificate authentication failed  for user "test (S114546)". but CN in the certificate matches with the user name in psql connection request.
> So certificate authentication should pass. It should fail afterwards.

Well, "test" is different from "test (S114546)", so what do you expect?

You should use a regular expression in "pg_ident.conf", if you want that to match:

  mymap  /^test  readonly

Yours,
Laurenz Albe,