pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Stephen Frost <sfrost@snowman.net>
To: Jacob Champion <pchampion@vmware.com>
Cc: magnus@hagander.net <magnus@hagander.net>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: Proposal: Save user's original authenticated identity for logging
Date: Mon, 1 Feb 2021 18:40:13 -0500
Message-ID: <20210201234013.GD27507@tamriel.snowman.net> (raw)
In-Reply-To: <12d26c8e9e3c9526a7b9e191513a8d948f31bbbe.camel@vmware.com>
References: <c55788dd1773c521c862e8e0dddb367df51222be.camel@vmware.com>
	<20210129220101.GE27507@tamriel.snowman.net>
	<e5bcc7f6bf9a3bd7751f97e2c34a5b877d3cbe4c.camel@vmware.com>
	<CABUevExLkKQFK3un7veD=yoztJO+gnAuAF4RTbdHLF+-pkAfYA@mail.gmail.com>
	<20210201164905.GI27507@tamriel.snowman.net>
	<57b741e9388f3bd97486615ea1f968c8eee9f055.camel@vmware.com>
	<20210201220126.GW27507@tamriel.snowman.net>
	<c4233543f0941a916ad60f555cfe9d88f9fc0c8c.camel@vmware.com>
	<20210201230146.GY27507@tamriel.snowman.net>
	<12d26c8e9e3c9526a7b9e191513a8d948f31bbbe.camel@vmware.com>

Greetings,

* Jacob Champion (pchampion@vmware.com) wrote:
> On Mon, 2021-02-01 at 18:01 -0500, Stephen Frost wrote:
> > Ok..  but what's 'go' mean here?  We already have views and such for GSS
> > and SSL, is the idea to add another view for LDAP and add in columns
> > that are returned by pg_stat_get_activity() which are then pulled out by
> > that view?  Or did you have something else in mind?
> 
> Magnus suggested a function like pg_get_authenticated_identity(), which
> is what I was thinking of when I said that. I'm not too interested in
> an LDAP-specific view, and I don't think anyone so far has asked for
> that.
> 
> My goal is to get this one single point of reference, for all of the
> auth backends. The LDAP mapping conversation is separate.

Presumably this would be the DN for SSL then..?  Not just the CN?  How
would the issuer DN be included?  And the serial?

Thanks,

Stephen

Attachments:

  [application/pgp-signature] signature.asc (818B, ../20210201234013.GD27507@tamriel.snowman.net/2-signature.asc)
  download

view thread (80+ messages)  latest in thread

Message-ID: <20210201234013.GD27507@tamriel.snowman.net>
Permalink:  ../20210201234013.GD27507@tamriel.snowman.net/
Also on:    postgresql.org/message-id/20210201234013.GD27507@tamriel.snowman.net

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: sfrost@snowman.net, pchampion@vmware.com, magnus@hagander.net
  Subject: Re: Proposal: Save user's original authenticated identity for logging
  In-Reply-To: <20210201234013.GD27507@tamriel.snowman.net>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox