Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1l6ioL-0006rh-C8 for pgsql-hackers@arkaria.postgresql.org; Mon, 01 Feb 2021 23:40:49 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1l6ino-0004vG-Oc for pgsql-hackers@arkaria.postgresql.org; Mon, 01 Feb 2021 23:40:16 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1l6ino-0004ud-Hj for pgsql-hackers@lists.postgresql.org; Mon, 01 Feb 2021 23:40:16 +0000 Received: from tamriel.snowman.net ([70.109.60.50]) by makus.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1l6inm-0001A1-Jh for pgsql-hackers@postgresql.org; Mon, 01 Feb 2021 23:40:15 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 0C9795F799; Mon, 1 Feb 2021 18:40:14 -0500 (EST) Date: Mon, 1 Feb 2021 18:40:13 -0500 From: Stephen Frost To: Jacob Champion Cc: "magnus@hagander.net" , "pgsql-hackers@postgresql.org" Subject: Re: Proposal: Save user's original authenticated identity for logging Message-ID: <20210201234013.GD27507@tamriel.snowman.net> References: <20210129220101.GE27507@tamriel.snowman.net> <20210201164905.GI27507@tamriel.snowman.net> <57b741e9388f3bd97486615ea1f968c8eee9f055.camel@vmware.com> <20210201220126.GW27507@tamriel.snowman.net> <20210201230146.GY27507@tamriel.snowman.net> <12d26c8e9e3c9526a7b9e191513a8d948f31bbbe.camel@vmware.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="hENGNq0p3/mEj3mX" Content-Disposition: inline In-Reply-To: <12d26c8e9e3c9526a7b9e191513a8d948f31bbbe.camel@vmware.com> User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --hENGNq0p3/mEj3mX Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Greetings, * Jacob Champion (pchampion@vmware.com) wrote: > On Mon, 2021-02-01 at 18:01 -0500, Stephen Frost wrote: > > Ok.. but what's 'go' mean here? We already have views and such for GSS > > and SSL, is the idea to add another view for LDAP and add in columns > > that are returned by pg_stat_get_activity() which are then pulled out by > > that view? Or did you have something else in mind? >=20 > Magnus suggested a function like pg_get_authenticated_identity(), which > is what I was thinking of when I said that. I'm not too interested in > an LDAP-specific view, and I don't think anyone so far has asked for > that. >=20 > My goal is to get this one single point of reference, for all of the > auth backends. The LDAP mapping conversation is separate. Presumably this would be the DN for SSL then..? Not just the CN? How would the issuer DN be included? And the serial? Thanks, Stephen --hENGNq0p3/mEj3mX Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJgGJFdAAoJEO1sijiDR2RV5OkQAMSOQBSz/HHCiZlWjSox88eo 25Fx7rHMwkMKyoUb0/pDy11xcJ9GONQ864YdEVCOJZeZIcZUt8eGrTzGR+S7szwe xpQvazZujJOc43PuApPddeuXO08KnjF/Cv+HaDXCfLDgBx2D0kyw1ppcB3go1NST V0E6RrYXw3KFw/QOGenMlBJFPSGkke12m5xXXythMBZQtLfIO+eQrzNnOTiEJfyX Cmwy0SCbiWLuTIJ56QlzhUCv0/izsZ2uFsMy/0SjUETEhJ0yHIDzv/PKnqelMH1F 3Y8/yO76QmOwMqg5fvTN0F2D5zPVHPxrVotQZK+X0q2L0d8M3iXxVi+9yqkRux8V TNK+cdFmRnT1R8prWKJS8YAkpqqyUPRncqXFB5ueMA3VGOin4ym68kp1FrAvBOnr 5SBmiNa/QJ239fcTDsnRE3/IvfnzpRqIA0fwawVM1t52iWEan+CCe1mb7MSteEyf tn86cwRbEl81hdFQKTHCAJSa1y75tkdKw/ZZMW5i8nSJCCZYYoH3ufmDSVYRk9gL ua8FFShRDOPDTDSDms6WrQrC21EagGxYHPekZCOfZADpi1dSNRrH9d9Szg/M7FdL qz1conePtNTAFMIM0G5R3832lyQaCWRyUaqRoyo2yDFX2oJpqhyVwZ7Hz4n0YEoA Dkt2ZaVBoVh4Nxnytl38 =RfbW -----END PGP SIGNATURE----- --hENGNq0p3/mEj3mX--