Date: Fri, 15 May 2015 09:24:07 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Haribabu Kommi <kommi.haribabu@gmail.com>
Cc: Peter Eisentraut <peter_e@gmx.net>, Andres Freund <andres@anarazel.de>,
 Greg Stark <stark@mit.edu>, Pavel Stehule <pavel.stehule@gmail.com>,
 Abhijit Menon-Sen <ams@2ndquadrant.com>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: Providing catalog view to pg_hba.conf file - Patch
 submission
Message-ID: <20150515132407.GU30322@tamriel.snowman.net>
References: 
 <CAJrrPGdXK3d6qYe7f8CkjK=3ckV++e8=dW2k4HsCgpz6-vNa0g@mail.gmail.com>
 <CAJrrPGfin+RCa_CT_pBMa4u31Aa7kcUOggQ4F1sMX3m5EUV-tA@mail.gmail.com>
 <55024C6C.6000207@gmx.net>
 <CAJrrPGe5Du0wmELzhWF0N-iiy6j5N0WNrhOhPuT5o5-bSCP6gA@mail.gmail.com>
 <CAFj8pRCYdtmceCxEtjSm9RjMiDSqVhC1QQdYSW3Fh6MQmYRgeA@mail.gmail.com>
 <CAJrrPGect-xLu+cmq9RN1EeGXvMeMJAtjWNxasKdyUjJKt0ksQ@mail.gmail.com>
 <CAM-w4HNDCbw6SBGutH2T9fRtYe-Wr1XPGAr3w_esav69LKXMMg@mail.gmail.com>
 <20150501163358.GE16366@awork2.anarazel.de>
 <5547DB0A.2020904@gmx.net>
 <CAJrrPGfJBy8QS+Y0zu1RQBVkp=tz4FcioHJw2Zowe6327-fT3w@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="U1BX1qUcBI2yZxll"
Content-Disposition: inline
In-Reply-To: 
 <CAJrrPGfJBy8QS+Y0zu1RQBVkp=tz4FcioHJw2Zowe6327-fT3w@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--U1BX1qUcBI2yZxll
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Haribabu Kommi (kommi.haribabu@gmail.com) wrote:
> On Tue, May 5, 2015 at 6:48 AM, Peter Eisentraut <peter_e@gmx.net> wrote:
> > On 5/1/15 12:33 PM, Andres Freund wrote:
> >> On 2015-04-08 19:19:29 +0100, Greg Stark wrote:
> >>> I'm not sure what the best way to handle the hand-off from patch
> >>> contribution to reviewer/committer. If I start tweaking things then
> >>> you send in a new version it's actually more work to resolve the
> >>> conflicts. I think at this point it's easiest if I just take it from
> >>> here.
> >>
> >> Are you intending to commit this?
> >
> > It still looks quite dubious to me.
> >
> > The more I test this, the more fond I grow of the idea of having this
> > information available in SQL.  But I'm also growing more perplexed by
> > how this the file is mapped to a table.  It just isn't a good match.
> >
> > For instance: What is keyword_databases?  Why is it an array?  Same for
> > keyword_users.  How can I know whether a given database or user matches
> > a keyword?  What is compare_method?  (Should perhaps be
> > keyword_address?)  Why is compare method set to "mask" when a hostname
> > is set?  (Column order is also a bit confusing here.)  I'd also like
> > options to be jsonb instead of a text array.
>=20
> Thanks for your suggestion. I am not sure how to use jsonb here, i
> will study the same
> and provide a patch for the next version.

Regarding "next version"- are you referring to 9.6 and therefore we
should go ahead and bounce this to the next CF, or were you planning to
post a "next version" of the patch today?

This is certainly a capability which I'd like to see, though I share
Peter's concerns regarding the splitting up of the keywords rather than
keeping the same structure as what's in the actual pg_hba.conf.  That
strikes me as confusing.  It'd be neat if we were able to change
pg_hba.conf to make more sense and then perhaps the SQL version wouldn't
look so different but I don't think there's any way to do that.

I discussed the patch briefing with Greg over IM, who pointed out that
keeping things just exactly as they are in the config file would mean
implementing, essentially, a pg_hba.conf parser in SQL.  I can
understand that perspective, but I don't think there's really much hope
in users being able to use this view directly without a lot of effort,
regardless.  We need to provide a function which takes the arguments
that our pg_hba lookup does (database, user-to-login-as, maybe system
user for pg_ident checks, optionally an IP, etc) and then returns the
record that matches.

Apologies for not being able to provide more feedback earlier.  I'll be
happy to help with all of the above and review the patch.

Independently, I'd love to see an SQL interface to pg_ident.conf too,
where, I expect anyway, it'll be a lot simpler, though I'm not sure that
it's very useful until we also have pg_hba.conf available through SQL.

	Thanks!

		Stephen

--U1BX1qUcBI2yZxll
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVVfN2AAoJEO1sijiDR2RVXbsP/jiLLBA55j2CFk9QI6tMftEs
tEFqRGlygT8pifA2ZSfy+csl8zOjjCnK2pi9oMtiy1i0WTJWLWQuIsYAOgBqD9yU
NTdpl0J9+yC7YNizWUbxZjTuYCDEdLMozfre+kcpa9AehJvAgAFT3CUZkzzsEgl6
DeZVL6C9Z92xS0RmF88REapKixVq48D4sjo10OAFIousisD5rtHCUxb8MdAQnaUa
nkj85ih8WdMlD/zRZoxvd3JFm8UdZ/vKhvwvWMsW/cvrZGrtdb8umX6OapysNB/7
lmW2FYOeR9bJkmFPdhhFUYMG9p58ckLhvdYTbrBzD6AUOuJfM/NHheL+gLj2X4Sm
OWA+FQqYwFIHzCErLPBZpaykiEzY3AxylzbN2ldyMD8cVGuOdLzfLuEGJ36Lev2L
oPdF/Z5mreBky/ijeReTOsXCb5l9RA/sjnRtAQ80B4PBc2XC52GSHMdRM0IrIO3I
nAnRo3ildR5zvwYi5far4uIYOUbNQBAHiueQEKBe/f2lkXpKJhwzpxdOYBo0F0L0
FICq6puAGXZBcfMV4ndhG+qKQPQVViS+WS4rHDnCchsuXQo6qObQf/0CM48IuZhn
VncNGgZMjWW5W3ghkHZmN3qh76H+3Q4nsHmsOBWm+nbi7Sh7v0SAeiMh1nQCbxEC
/KFOwI5yce0kE6TogRss
=NIfi
-----END PGP SIGNATURE-----

--U1BX1qUcBI2yZxll--