Date: Fri, 27 Feb 2015 13:35:18 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Tomas Vondra <tomas.vondra@2ndquadrant.com>
Cc: pgsql-hackers@postgresql.org
Subject: Re: Providing catalog view to pg_hba.conf file - Patch
 submission
Message-ID: <20150227183518.GR29780@tamriel.snowman.net>
References: <82897A1301080E4B8E461DDAA0FFCF14FD6E@SYD1216>
 <20140629165554.GA5984@toroid.org>
 <20140630070646.GY31357@toroid.org>
 <CAJrrPGe3sZWKFfsHDCJMXfBOqkf6_w6R_DpsUYn2vQK_tVeU1g@mail.gmail.com>
 <54C8156E.1080500@BlueTreble.com>
 <CAJrrPGcFk9_svvipFJeLBrVJYOmq6uNy38NsT8jtfo6Bks5RYw@mail.gmail.com>
 <54C95C4B.2080901@BlueTreble.com>
 <54F09D68.2090700@2ndquadrant.com>
 <20150227165950.GP29780@tamriel.snowman.net>
 <54F0ADEE.6070004@2ndquadrant.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="JvcFcSNq1wOCYqbI"
Content-Disposition: inline
In-Reply-To: <54F0ADEE.6070004@2ndquadrant.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--JvcFcSNq1wOCYqbI
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Tomas Vondra (tomas.vondra@2ndquadrant.com) wrote:
> On 27.2.2015 17:59, Stephen Frost wrote:
> > All,
> >=20
> > * Tomas Vondra (tomas.vondra@2ndquadrant.com) wrote:
> >>
> >> The other feature that'd be cool to have is a debugging function
> >> on top of the view, i.e. a function pg_hba_check(host, ip, db,
> >> user, pwd) showing which hba rule matched. But that's certainly=20
> >> nontrivial.
> >=20
> > I'm not sure that I see why, offhand, it'd be much more than trivial
> > ...
>=20
> From time to time I have to debug why are connection attempts failing,
> and with moderately-sized pg_hba.conf files (e.g. on database servers
> shared by multiple applications) that may be tricky. Identifying the
> rule that matched (and rejected) the connection would be helpful.

To clarify, I was trying to say that writing that function didn't seem
very difficult to me.  I definitely think that *having* that function
would be very useful.

> But yes, that's non-trivial and out of scope of this patch.

For my 2c, I view this as somewhat up to the author.  I wouldn't
complain if it was included in a new version of this patch as I don't
think it'd add all that much complexity and it'd be very nice, but I
certainly think this patch could go in without that too.

	Thanks!

		Stephen

--JvcFcSNq1wOCYqbI
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJU8LjmAAoJEO1sijiDR2RVZsIQAK/LJ6eGPPEQcc1x5toaSHgq
nraZuw2PCheCARqgQhTf9Sp5iJwGmnG2Qr13/wOJuqVPj0DxQfCaA9nPRIKd9Yzs
Q10vLcGDFKAskCO+fFmGuElSG1d19r5Y9agQb7cozDiFGyzq+k1r02Z1Li/aqrke
0hoKEr0IEOVaQkdoaXaP42qDeiyNSr0+3GLFhk3v3CFbS+J+yHObh5N3oCscYCxP
rTh2EfO+MmJUVLjkWtk874sD00BF/zGmgsJmo1oQ4Ypsn10LhUHuxFtKKRoi6bSG
DwnFM38x1KB+shl0wSISJDi3O+QwMli4bcEg/FHyqxD29CiWegKRqECG71umLpCf
awdJgNLy3FfowK62WgzlKTPOYl9/PT18wAksIHTaiowFWiU1V02n+RyZVYX+xYE5
GrlMxFRatmyNkzlx/D3oywiv5jjQ5AhKoVur419GNiqmd50sdJ3W7hnylAkbaK73
U/j8IgU7gReTQ21rmtetL9a5ZA8OxVgEnes25bRnsBbyvp/FqsXaJN2jYl/0iOY5
wkSNDprFAIL7jdXUNQrLQ2W1GMpKMHI8sD8GchYwo6paa9osNuUld7SFUEhLUR5t
6RgdkLpeAhdfH20q9f7YtCpSAtoTWYm84lVYEc5ijz2iCmtgHkduE8clqX5JsVGY
w97HywzPpCNXTK301KQX
=/7xA
-----END PGP SIGNATURE-----

--JvcFcSNq1wOCYqbI--