public inbox for [email protected]  

help / color / mirror / Atom feed

From: Tom Lane <[email protected]>
To: Drew Zoellner <[email protected]>
Cc: [email protected]
Cc: [email protected]
Subject: Re: Replication using mTLS issue
Date: Fri, 21 Jun 2024 14:24:01 -0400
Message-ID: <[email protected]> (raw)
In-Reply-To: <CAGWxRFdmR8W0O7CK-UTcBjPxRp-MSh0J_jC4GmE3JA2FaP_yaQ@mail.gmail.com>
References: <CAGWxRFfWbD3NNJcpiPA6+g+UYRHAmD6Z4+rQaHoNi5+EEt1gOg@mail.gmail.com>
	<[email protected]>
	<CAGWxRFdmR8W0O7CK-UTcBjPxRp-MSh0J_jC4GmE3JA2FaP_yaQ@mail.gmail.com>

Drew Zoellner <[email protected]> writes:
> So the same user is able to connect using a non replication connection
> using the same mtls certificate and pg_ident.conf map. So it seems like the
> cert & map are working for this user.

Hmph.  I tried to reproduce your problem, and it works for me: I can
create a replication connection that's authenticated by certificate
and relies on a username map to map from the CN in the client
certificate to the database username that's mentioned in the "hostssl
replication" entry.

All I can suggest at this point is to go over your configuration
with a fine-tooth comb, looking for probably-silly mistakes such as
inconsistent spellings.  One thing I can think of to mention in
particular is to be sure that the standby's primary_conninfo
explicitly includes "user=pgrepmgr_nonprod", as that's likely not the
user name it'd default to.

Another idea could be to enable log_connections on the primary,
and see if the incoming connection request looks different than
you were expecting.

			regards, tom lane

view thread (2+ messages)

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: Replication using mTLS issue
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox