Date: Mon, 1 Feb 2021 17:01:26 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Jacob Champion <pchampion@vmware.com>
Cc: "magnus@hagander.net" <magnus@hagander.net>,
	"pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Subject: Re: Proposal: Save user's original authenticated identity for logging
Message-ID: <20210201220126.GW27507@tamriel.snowman.net>
References: <c55788dd1773c521c862e8e0dddb367df51222be.camel@vmware.com>
 <20210129220101.GE27507@tamriel.snowman.net>
 <e5bcc7f6bf9a3bd7751f97e2c34a5b877d3cbe4c.camel@vmware.com>
 <CABUevExLkKQFK3un7veD=yoztJO+gnAuAF4RTbdHLF+-pkAfYA@mail.gmail.com>
 <20210201164905.GI27507@tamriel.snowman.net>
 <57b741e9388f3bd97486615ea1f968c8eee9f055.camel@vmware.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="yVXkZ6wLsKv9EYuM"
Content-Disposition: inline
In-Reply-To: <57b741e9388f3bd97486615ea1f968c8eee9f055.camel@vmware.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--yVXkZ6wLsKv9EYuM
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Jacob Champion (pchampion@vmware.com) wrote:
> On Mon, 2021-02-01 at 11:49 -0500, Stephen Frost wrote:
> > * Magnus Hagander (magnus@hagander.net) wrote:
> > > But yes, I think the enforced cleartext password proxying is at the
> > > core of the problem. LDAP also encourages the idea of centralized
> > > password-reuse, which is not exactly a great thing for security.
> >=20
> > Right- passing around a user's password in the clear (or even through an
> > encrypted tunnel) has been strongly discouraged for a very long time,
> > for very good reason.  LDAP does double-down on that by being a
> > centralized password, meaning that someone's entire identity (for all
> > the services that share that LDAP system, at least) are compromised if
> > any one system in the environment is.
>=20
> Sure. I don't disagree with anything you've said in that paragraph, but
> as someone who's implementing solutions for other people who are
> actually deploying, I don't have a lot of control over whether a
> customer's IT department wants to use LDAP or not. And I'm not holding
> my breath for LDAP servers to start implementing federated identity,
> though that would be nice.

Not sure exactly what you're referring to here but AD already provides
Kerberos with cross-domain trusts (aka forests).  The future is here..?
:)

> > Also, if we do add
> > it, I would think we'd have it under the same check as the other
> > sensitive pg_stat_activity fields and not be superuser-only.
>=20
> Just the standard HAS_PGSTAT_PERMISSIONS(), then?
>=20
> To double-check -- since giving this ability to the pg_read_all_stats
> role would expand its scope -- could that be dangerous for anyone?

I don't agree that this really expands its scope- in fact, you'll see
that the GSSAPI and SSL user authentication information is already
allowed under HAS_PGSTAT_PERMISSIONS().

Thanks,

Stephen

--yVXkZ6wLsKv9EYuM
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJgGHo2AAoJEO1sijiDR2RV0B0P/idn29LhLfnY89mQECION7k4
M7KPeRL0g8VjiqmPYWnHHwLeJJxTaWIHeCywF24JBFNUNA+af/xz6NOeJsdf9pvw
Z5w/5nFwsMrhgwKcPddCIFViNN4oX/a9zdEacqwmVI7CxnB6Mkz5n9QSjb/w4VfZ
OQo8Ni1MWz2HdSceyGbws5XWHwmWXN8oaY08X6gncWUF9IJJkBWSaFt7c7IRmSeZ
r6XeLgD4MWSaDj4YOk2BjLLIwBKGIe99z9zM6m7kpj5IHgOZeuWtIYjGDNGMKGsq
XbwMiy/XYYGr+vGGi4cbX5mvczHLoJL42UvWtw09z3qsSlsEq/uW9qICxlzgu9EV
TcLBiDOM3RiPXaz1s1hyKrASKJCDbU1IY8/FP8gUAA53RiZywqV7sofKmu7cStXi
a8QbOrnfQYHe0kKqSfGo1h4rG473IsgiVpM9nvdJdwwZZobWWfw1fWmOJdd8uyzH
UqrWpyhihl7OiJVWyUOpLGBP79t0JsQlb8Jzzd44Xi66aswT1hdNQbjGK1kQ5jXh
nRLJY8ZFYbwc2xmtTbxZ69IkRWttwhQ0u22vVVb40yLGA8U5Wx70DwoU/71N5wFD
Z3xq8CWX+jUsmf2OxR8y5wJDcKoI6D+o+gh2Pwm0vN3nrWdzwouiLGbt7udANqaD
Sh4QSzc8HmzlpaY46DDG
=mh9w
-----END PGP SIGNATURE-----

--yVXkZ6wLsKv9EYuM--