From: Drouvot, Bertrand <bertranddrouvot.pg@gmail.com>
To: Michael Paquier <michael@paquier.xyz>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: [PATCH] Add peer authentication TAP test
Date: Wed, 28 Sep 2022 09:12:57 +0200
Message-ID: <2ecffb46-8b0c-83cb-2577-bf83262b5f10@gmail.com> (raw)
In-Reply-To: <YzPhGhI0dyC4/IAG@paquier.xyz>
References: <aa60994b-1c66-ca7a-dab9-9a200dbac3d2@amazon.com>
<YzPhGhI0dyC4/IAG@paquier.xyz>
Hi,
On 9/28/22 7:52 AM, Michael Paquier wrote:
> On Fri, Aug 26, 2022 at 10:43:43AM +0200, Drouvot, Bertrand wrote:
>> During the work in [1] we created a new TAP test to test the SYSTEM_USER
>> behavior with peer authentication.
>>
>> It turns out that there is currently no TAP test for the peer
>> authentication, so we think (thanks Michael for the suggestion [2]) that
>> it's better to split the work in [1] between "pure" SYSTEM_USER related work
>> and the "pure" peer authentication TAP test work.
>>
>> That's the reason of this new thread, please find attached a patch to add a
>> new TAP test for the peer authentication.
>
> +# Get the session_user to define the user name map test.
> +my $session_user =
> + $node->safe_psql('postgres', 'select session_user');
> [...]
> +# Define a user name map.
> +$node->append_conf('pg_ident.conf', qq{mypeermap $session_user testmap$session_user});
> +
> +# Set pg_hba.conf with the peer authentication and the user name map.
> +reset_pg_hba($node, 'peer map=mypeermap');
>
> A map consists of a "MAPNAME SYSTEM_USER PG_USER". Why does this test
> use a Postgres role (from session_user) as the system user for the
> peer map?
Thanks for looking at it!
Initially selecting the session_user with a "local" connection and no
user provided during the connection is a way I came up to retrieve the
"SYSTEM_USER" to be used later on in the map.
Maybe the variable name should be system_user instead or should we use
another way to get the "SYSTEM_USER" to be used in the map?
Regards,
--
Bertrand Drouvot
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: bertranddrouvot.pg@gmail.com, michael@paquier.xyz, pgsql-hackers@lists.postgresql.org
Subject: Re: [PATCH] Add peer authentication TAP test
In-Reply-To: <2ecffb46-8b0c-83cb-2577-bf83262b5f10@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox