public inbox for [email protected]
help / color / mirror / Atom feedFrom: Tom Lane <[email protected]>
To: Drew Zoellner <[email protected]>
Cc: [email protected]
Cc: [email protected]
Subject: Re: Replication using mTLS issue
Date: Fri, 21 Jun 2024 12:46:22 -0400
Message-ID: <[email protected]> (raw)
In-Reply-To: <CAGWxRFfWbD3NNJcpiPA6+g+UYRHAmD6Z4+rQaHoNi5+EEt1gOg@mail.gmail.com>
References: <CAGWxRFfWbD3NNJcpiPA6+g+UYRHAmD6Z4+rQaHoNi5+EEt1gOg@mail.gmail.com>
Drew Zoellner <[email protected]> writes:
> Hi Postgres team, I’m receiving an issue matching pg_hba rules that I can’t
> seem to sort out. I am trying to use mtls certificate authentication for
> physical replication connections but keep receiving the following error…
> pg_receivewal: error: FATAL: no pg_hba.conf entry for replication
> connection from host "100.84.12.223", user "pgrepmgr_nonprod", SSL on
> My pg_hba.conf file contains
> hostssl replication pgrepmgr_nonprod 100.0.0.0/8 cert map=pgrepmgr_nonprod_map
Hm, the match failure must be on user name. What certificate are you
using on the client side, and what user name does pgrepmgr_nonprod_map
map it to? Does it succeed if you weaken the hba entry to
hostssl replication all 100.0.0.0/8 cert map=pgrepmgr_nonprod_map
> Is cert authentication supported for replication connections?
Should be. But you might find it easier to debug the auth failure
in a non-replication context, ie add
hostssl all pgrepmgr_nonprod 100.0.0.0/8 cert map=pgrepmgr_nonprod_map
and then see if you can connect with the same credentials from psql
or your favorite other client.
BTW, don't forget you have to signal the postmaster to reload
configuration after any change in these files.
regards, tom lane
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected], [email protected]
Subject: Re: Replication using mTLS issue
In-Reply-To: <[email protected]>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox