Date: Mon, 1 Feb 2021 18:01:46 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Jacob Champion <pchampion@vmware.com>
Cc: "magnus@hagander.net" <magnus@hagander.net>,
	"pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Subject: Re: Proposal: Save user's original authenticated identity for logging
Message-ID: <20210201230146.GY27507@tamriel.snowman.net>
References: <c55788dd1773c521c862e8e0dddb367df51222be.camel@vmware.com>
 <20210129220101.GE27507@tamriel.snowman.net>
 <e5bcc7f6bf9a3bd7751f97e2c34a5b877d3cbe4c.camel@vmware.com>
 <CABUevExLkKQFK3un7veD=yoztJO+gnAuAF4RTbdHLF+-pkAfYA@mail.gmail.com>
 <20210201164905.GI27507@tamriel.snowman.net>
 <57b741e9388f3bd97486615ea1f968c8eee9f055.camel@vmware.com>
 <20210201220126.GW27507@tamriel.snowman.net>
 <c4233543f0941a916ad60f555cfe9d88f9fc0c8c.camel@vmware.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="SelTVa2eg31e6zx2"
Content-Disposition: inline
In-Reply-To: <c4233543f0941a916ad60f555cfe9d88f9fc0c8c.camel@vmware.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--SelTVa2eg31e6zx2
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Jacob Champion (pchampion@vmware.com) wrote:
> On Mon, 2021-02-01 at 17:01 -0500, Stephen Frost wrote:
> > * Jacob Champion (pchampion@vmware.com) wrote:
> > > And I'm not holding
> > > my breath for LDAP servers to start implementing federated identity,
> > > though that would be nice.
> >=20
> > Not sure exactly what you're referring to here but AD already provides
> > Kerberos with cross-domain trusts (aka forests).  The future is here..?
> > :)
>=20
> If the end user is actually using LDAP-on-top-of-AD, and comfortable
> administering the Kerberos-related pieces of AD so that their *nix
> servers and users can speak it instead, then sure. But I continue to
> hear about customers who don't fit into that mold. :D Enough that I
> have to keep an eye on the "pure" LDAP side of things, at least.

I suppose it's likely that I'll continue to run into people who are
horrified to learn that they've been using pass-the-password auth thanks
to using ldap.

> > > To double-check -- since giving this ability to the pg_read_all_stats
> > > role would expand its scope -- could that be dangerous for anyone?
> >=20
> > I don't agree that this really expands its scope- in fact, you'll see
> > that the GSSAPI and SSL user authentication information is already
> > allowed under HAS_PGSTAT_PERMISSIONS().
>=20
> Ah, so they are. :) I think that's the way to go, then.

Ok..  but what's 'go' mean here?  We already have views and such for GSS
and SSL, is the idea to add another view for LDAP and add in columns
that are returned by pg_stat_get_activity() which are then pulled out by
that view?  Or did you have something else in mind?

Thanks,

Stephen

--SelTVa2eg31e6zx2
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJgGIhaAAoJEO1sijiDR2RVYhEP/2psJQxQhdb6QUub5BZYpAH/
gj/sbu39rA0NmZPgk6Ao/csV+Os0EgIjRado6NU3aIl9+yW7i0ZkkaNnnizb05GR
+MHvoNezMc1Z4hPGgBndsX7m2Vqweq5B9tze2fCkidgrYlImYFYxpC+3ebfHo+ac
2eSVVkSSooZYTAS5IzM5knmG/SmvKl4ZfeitrzTVbkLTeBgVoIc4lz4bX+b/e5tw
2wynWJIlKy9a57EC4oujeDBm37tJR6NoFiKgUBwONykTPG402zgOT6njZm/1ga4K
I8Ex55MAIM2GZnixmjGUwDUv5CSiXp72uTDxdn70B1JGQC2Ev5yPzBzkLTis/Jvq
qKTds1gFIuTSj6BpheENqq8Ji2alr+sBe14Lbqb7l3dtL5t2Q4rc4XW0OixN2FKW
TO73S3g6mwFaZkEvMcZ8d7g0WghktmJsbCSqoZ7vokkz1oKGAk5F/k4EejXO1qNa
hWP5FpMTEE3gUR1yVjRe4gqlqn+E/yDA+yR4JaVzCs5+J/QO8L+6lwSeOgzZAe4y
u77a5HwcdDXhm+Oe9JvV0mRt7M6hPDHEyQBrgT9CRnUbxF2fZGFl6qBSkH+oY3WQ
9epu4R+9heZgD9eeII67EL5O62FKsmA3DYMDa/5QWU3WOeNoQWuVe10YNaiRiQEL
akzguyeX2Jt9AnpUH8jq
=T3SF
-----END PGP SIGNATURE-----

--SelTVa2eg31e6zx2--