MIME-Version: 1.0
In-Reply-To: <1738731565.8400.1726010470879.JavaMail.zimbra@tryx.org>
References: <172601029329.1028.17318986799853058856@malur.postgresql.org> <1738731565.8400.1726010470879.JavaMail.zimbra@tryx.org>
From: "David G. Johnston" <david.g.johnston@gmail.com>
Date: Tue, 10 Sep 2024 16:26:19 -0700
Message-ID: <CAKFQuwbpdwCxDgY5cjDh-8uneNA010BLfd8TEGF5BJOksxRtbg@mail.gmail.com>
Subject: Re: Test mail for pgsql-general
To: Chris Miller <cjm@tryx.org>
Cc: pgsql-general <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="0000000000007333440621cc33c8"
Archived-At: <https://www.postgresql.org/message-id/CAKFQuwbpdwCxDgY5cjDh-8uneNA010BLfd8TEGF5BJOksxRtbg%40mail.gmail.com>
Precedence: bulk

--0000000000007333440621cc33c8
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tuesday, September 10, 2024, Chris Miller <cjm@tryx.org> wrote:

> Hi Folks,
>
> I am confused about authentication. I understand that in the local
> connection case, I have choices of =E2=80=9Cpeer=E2=80=9D, and =E2=80=9Cm=
d5=E2=80=9D (password).
>
>
> In pg_hba.conf, I have the lines:
>
>
> local all all peer
>
> local all all md5
>
>
The second line is pointless, the first three columns are compared against
the incoming connection host/user/dbname to find out how authentication
should be handled.  The first match wins.  So for every local connection
peer, and only peer, is going to be used since everything matches all/all.

There is no way to give a user a choice of how to authenticate.  There will
be one accepted option for a given set of connection values.

David J.

--0000000000007333440621cc33c8
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tuesday, September 10, 2024, Chris Miller &lt;<a href=3D"mailto:cjm@tryx=
.org">cjm@tryx.org</a>&gt; wrote:<br><blockquote class=3D"gmail_quote" styl=
e=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><d=
iv style=3D"font-family:arial,helvetica,sans-serif;font-size:12pt;color:#00=
0000"><div>Hi Folks,<br></div><div><br></div><div><p style=3D"line-height:1=
00%;margin:0px">I am confused about authentication. I understand that in th=
e local connection case, I have choices of =E2=80=9Cpeer=E2=80=9D, and =E2=
=80=9Cmd5=E2=80=9D (password).</p><p style=3D"line-height:100%;margin:0px">=
<br></p><p style=3D"line-height:100%;margin:0px">In pg_hba.conf, I have the=
 lines:</p><p style=3D"line-height:100%;margin:0px"><br></p><p style=3D"lin=
e-height:100%;margin:0px;padding-left:40px"><span style=3D"font-family:Libe=
ration Mono,monospace">local all all peer</span></p><p style=3D"line-height=
:100%;margin:0px;padding-left:40px"><span style=3D"font-family:Liberation M=
ono,monospace">local all all md5</span></p><p style=3D"line-height:100%;mar=
gin:0px;padding-left:40px"></p></div></div></div></blockquote><div><br></di=
v><div>The second line is pointless, the first three columns are compared a=
gainst the incoming connection host/user/dbname to find out how authenticat=
ion should be handled.=C2=A0 The first match wins.=C2=A0 So for every local=
 connection peer, and only peer, is going to be used since everything match=
es all/all.</div><div><br></div><div>There is no way to give a user a choic=
e of how to authenticate.=C2=A0 There will be one accepted option for a giv=
en set of connection values.</div><div><br></div><div>David J.</div><div>=
=C2=A0</div>

--0000000000007333440621cc33c8--