public inbox for [email protected]
help / color / mirror / Atom feedFrom: Peter J. Holzer <[email protected]>
To: [email protected]
Subject: Re: password rules
Date: Wed, 25 Jun 2025 13:55:35 +0200
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>
On 2025-06-23 16:35:35 +0200, raphi wrote:
> To be fair, setting up LDAP is very easy in PG, just one line in hba.conf
> and all is done. But sadly, that's only where the problems begin. The
> difficult part is to embedd this setup into a company, especially a large
> one as I work for with over 1000 PG databases and at least that many roles.
> Someone needs to be able to manage the passwords in LDAP and this means
> someone has to decide who can change which passwords, which is usually where
> some sort of Identity and Access Management (IAM) comes into place.
>
> We already have LDAP and IAM in place in our organization for many other
> things, but IAM identities are coupled to a real person, not a team. Which
> means only one person in the team would be able to set a new password and
> when that person leaves the team, IAM rights need to be revoked and given to
> a new person. Doable, but quite a pane in the behind, especially when that
> one person happens to be on holidays.
I don't see why that should be the case. You could either grant
privileges to more than one person or - preferrably - to a role which is
then granted to the personal roles.
So for example you would authenticate as «raphi» and I as «hjp» but we
could both change to «foo_admin» or whatever. That would even have the
advantage that we leave an audit trail with our "real" identities.
hjp
--
_ | Peter J. Holzer | Story must make more sense than reality.
|_|_) | |
| | | [email protected] | -- Charles Stross, "Creative writing
__/ | http://www.hjp.at/ | challenge!"
Attachments:
[application/pgp-signature] signature.asc (833B, 2-signature.asc)
download
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected]
Subject: Re: password rules
In-Reply-To: <[email protected]>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox