Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1ub1Sv-00ClqP-Eh for pgsql-docs@arkaria.postgresql.org; Sun, 13 Jul 2025 18:30:21 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1ub1St-00HUfl-HB for pgsql-docs@arkaria.postgresql.org; Sun, 13 Jul 2025 18:30:20 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1ub1St-00HUfd-9l for pgsql-docs@lists.postgresql.org; Sun, 13 Jul 2025 18:30:19 +0000 Received: from sss.pgh.pa.us ([68.162.161.243]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1ub1Ss-0076jl-0S for pgsql-docs@lists.postgresql.org; Sun, 13 Jul 2025 18:30:19 +0000 Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1]) by sss.pgh.pa.us (8.15.2/8.15.2) with ESMTP id 56DIUDmt435404; Sun, 13 Jul 2025 14:30:13 -0400 From: Tom Lane To: "David G. Johnston" cc: alexey.shishkin@enterprisedb.com, pgsql-docs@lists.postgresql.org Subject: Re: correction suggestion for https://www.postgresql.org/docs/17/auth-username-maps.html In-reply-to: <1409232.1752098746@sss.pgh.pa.us> References: <175206279327.3157504.12519088928605422253@wrigleys.postgresql.org> <1145313.1752078127@sss.pgh.pa.us> <1341070.1752089404@sss.pgh.pa.us> <1409232.1752098746@sss.pgh.pa.us> Comments: In-reply-to Tom Lane message dated "Wed, 09 Jul 2025 18:05:46 -0400" MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----- =_aaaaaaaaaa0" Content-ID: <435346.1752431397.0@sss.pgh.pa.us> Date: Sun, 13 Jul 2025 14:30:13 -0400 Message-ID: <435403.1752431413@sss.pgh.pa.us> List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk ------- =_aaaaaaaaaa0 Content-Type: text/plain; charset="us-ascii" Content-ID: <435346.1752431397.1@sss.pgh.pa.us> I figured out how to make the 003_peer.pl tests for \1 less hacky, and pushed that. Here's a proposed patch for the documentation side of things, including your suggestion to make pg_ident.conf.sample match up better. regards, tom lane ------- =_aaaaaaaaaa0 Content-Type: text/x-diff; name="v2-0001-reword-pg_ident.conf-docs.patch"; charset="us-ascii" Content-ID: <435346.1752431397.2@sss.pgh.pa.us> Content-Description: v2-0001-reword-pg_ident.conf-docs.patch Content-Transfer-Encoding: quoted-printable diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml index 832b616a7bb..51b95ed04f3 100644 --- a/doc/src/sgml/client-auth.sgml +++ b/doc/src/sgml/client-auth.sgml @@ -1003,8 +1003,9 @@ local db1,db2,@demodbs all = md5 the remainder of the field is treated as a regular expression. (See for details of PostgreSQL's regular expression syntax.) T= he regular - expression can include a single capture, or parenthesized subexpressio= n, - which can then be referenced in the database-username + expression can include a single capture, or parenthesized subexpressio= n. + The portion of the system user name that matched the capture can then + be referenced in the database-username field as \1 (backslash-one). This allows the mappi= ng of multiple user names in a single line, which is particularly useful for simple syntax substitutions. For example, these entries @@ -1022,12 +1023,11 @@ mymap /^(.*)@otherdomain\.com$ guest If the database-username field starts with a slash (/), the remainder of the field is treated - as a regular expression (see - for details of PostgreSQL's regular - expression syntax). It is not possible to use \1 - to use a capture from regular expression on - system-username for a regular expression - on database-username. + as a regular expression. + When the database-username field is a regul= ar + expression, it is not possible to use \1 within it = to + refer to a capture from the system-username + field. = diff --git a/src/backend/libpq/pg_ident.conf.sample b/src/backend/libpq/pg= _ident.conf.sample index f5225f26cdf..8ee6c0ba315 100644 --- a/src/backend/libpq/pg_ident.conf.sample +++ b/src/backend/libpq/pg_ident.conf.sample @@ -13,25 +13,25 @@ # user names to their corresponding PostgreSQL user names. Records # are of the form: # -# MAPNAME SYSTEM-USERNAME PG-USERNAME +# MAPNAME SYSTEM-USERNAME DATABASE-USERNAME # # (The uppercase quantities must be replaced by actual values.) # # MAPNAME is the (otherwise freely chosen) map name that was used in # pg_hba.conf. SYSTEM-USERNAME is the detected user name of the -# client. PG-USERNAME is the requested PostgreSQL user name. The -# existence of a record specifies that SYSTEM-USERNAME may connect as -# PG-USERNAME. +# client. DATABASE-USERNAME is the requested PostgreSQL user name. +# The existence of a record specifies that SYSTEM-USERNAME may connect +# as DATABASE-USERNAME. # -# If SYSTEM-USERNAME starts with a slash (/), it will be treated as a -# regular expression. Optionally this can contain a capture (a -# parenthesized subexpression). The substring matching the capture -# will be substituted for \1 (backslash-one) if present in -# PG-USERNAME. +# If SYSTEM-USERNAME starts with a slash (/), the rest of it will be +# treated as a regular expression. Optionally this can contain a capture +# (a parenthesized subexpression). The substring matching the capture +# will be substituted for \1 (backslash-one) if that appears in +# DATABASE-USERNAME. # -# PG-USERNAME can be "all", a user name, a group name prefixed with "+", = or -# a regular expression (if it starts with a slash (/)). If it is a regul= ar -# expression, the substring matching with \1 has no effect. +# DATABASE-USERNAME can be "all", a user name, a group name prefixed with= "+", +# or a regular expression (if it starts with a slash (/)). If it is a re= gular +# expression, no substitution for \1 will occur. # # Multiple maps may be specified in this file and used by pg_hba.conf. # @@ -69,4 +69,4 @@ # Put your actual configuration here # ---------------------------------- = -# MAPNAME SYSTEM-USERNAME PG-USERNAME +# MAPNAME SYSTEM-USERNAME DATABASE-USERNAME ------- =_aaaaaaaaaa0--