From: Drouvot, Bertrand <bdrouvot@amazon.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
To: Jacob Champion <jchampion@timescale.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Patch proposal: make use of regular expressions for the username in pg_hba.conf
Date: Fri, 9 Sep 2022 12:31:08 +0200
Message-ID: <1128e76f-e828-b579-4646-05e8cb021d0e@amazon.com> (raw)
In-Reply-To: <4177827.1662684400@sss.pgh.pa.us>
References: <fff0d7c1-8ad4-76a1-9db3-0ab6ec338bf7@amazon.com>
<CAAWbhmhifLJfCGk1zMjWNHg+uGo9SohdSEqsFo0wa2rBNCB85g@mail.gmail.com>
<4177827.1662684400@sss.pgh.pa.us>
Hi,
On 9/9/22 2:46 AM, Tom Lane wrote:
> Jacob Champion<jchampion@timescale.com> writes:
>> On Fri, Aug 19, 2022 at 1:13 AM Drouvot, Bertrand<bdrouvot@amazon.com> wrote:
>>> This is why I think username filtering with regular expressions would
>>> provide its own advantages.
>> I think your motivation for the feature is solid.
> Yeah. I'm not sure that I buy the argument that this is more useful
> than writing a role name and controlling things with GRANT ROLE, but
> it's a plausible alternative with properties that might win in some
> use-cases. So I see little reason not to allow it.
Thank you both for your feedback.
> I'd actually ask why stop here? In particular, why not do the same
> with the database-name column, especially since that does *not*
> have the ability to use roles as a substitute for a wildcard entry?
I think that's a fair point, I'll look at it.
>> I think you're going to have to address backwards compatibility
>> concerns. Today, I can create a role named "/a", and I can put that
>> into the HBA without quoting it. I'd be unamused if, after an upgrade,
>> my rule suddenly matched any role name containing an 'a'.
> Meh ... that concern seems overblown to me. I guess it's possible
> that somebody has an HBA entry that looks like that, but it doesn't
> seem very plausible. Note that we made this exact same change in
> pg_ident.conf years ago, and AFAIR we got zero complaints.
>
Agree that it seems unlikely but maybe we could add a new GUC to turn
the regex usage on the hba file on/off (and use off as the default)?
Regards,
--
Bertrand Drouvot
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services:https://aws.amazon.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: bdrouvot@amazon.com, tgl@sss.pgh.pa.us, jchampion@timescale.com, pgsql-hackers@lists.postgresql.org
Subject: Re: Patch proposal: make use of regular expressions for the username in pg_hba.conf
In-Reply-To: <1128e76f-e828-b579-4646-05e8cb021d0e@amazon.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox