pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Jacob Champion <pchampion@vmware.com>
To: magnus@hagander.net <magnus@hagander.net>
Cc: stark@mit.edu <stark@mit.edu>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Cc: sfrost@snowman.net <sfrost@snowman.net>
Cc: tgl@sss.pgh.pa.us <tgl@sss.pgh.pa.us>
Subject: Re: Proposal: Save user's original authenticated identity for logging
Date: Tue, 9 Mar 2021 00:48:20 +0000
Message-ID: <36ad4829f46a30b16355b60d45f43f89b89dac52.camel@vmware.com> (raw)
In-Reply-To: <49b2d3032f96226d2c82b370ecf6026147aeca2d.camel@vmware.com>
References: <c55788dd1773c521c862e8e0dddb367df51222be.camel@vmware.com>
	<a9ee5e4e8e844d06c2bcf70c6ed3306ccb4897f1.camel@vmware.com>
	<5d8b74e64fe4a610b23624277e497cc0a925db4b.camel@vmware.com>
	<2870147caa759155c5c8a232bbd2399f41f76491.camel@vmware.com>
	<4b2ca51542fa84e6fa37ab678624d5b400c092c0.camel@vmware.com>
	<CABUevExVHryTasKmtJW5RtU-dBesYj4bV7ggpeVMfiPCHCvLNA@mail.gmail.com>
	<a2fab8e350c86aa4fe245d1af521b0bbc807f11e.camel@vmware.com>
	<49b2d3032f96226d2c82b370ecf6026147aeca2d.camel@vmware.com>

On Sat, 2021-03-06 at 18:33 +0100, Magnus Hagander wrote:
> In fact, if we're storing it in the Port, why
> are we even passing it as a separate parameter to check_usermap --
> shouldn't that one always use this same value?

Ah, and now I remember why I didn't consolidate this to begin with.
Several auth methods perform some sort of translation before checking
the usermap: cert pulls the CN out of the Subject DN, SSPI and GSS can
optionally strip the realm, etc.

> ISTM that it could be
> quite confusing if the logged value is different from whatever we
> apply to the user mapping?

Maybe. But it's an accurate reflection of what's actually happening,
and that's the goal of the patch: show enough information to be able to
audit who's logging in. The certificates

    /OU=ACME Ltd./C=US/CN=pchampion

and

    /OU=Postgres/C=GR/CN=pchampion

are different identities, but Postgres will silently authorize them to
log in as the same user. In my opinion, hiding that information makes
things more confusing in the long term, not less.

--Jacob


view thread (80+ messages)  latest in thread

Message-ID: <36ad4829f46a30b16355b60d45f43f89b89dac52.camel@vmware.com>
Permalink:  ../36ad4829f46a30b16355b60d45f43f89b89dac52.camel@vmware.com/
Also on:    postgresql.org/message-id/36ad4829f46a30b16355b60d45f43f89b89dac52.camel@vmware.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: pchampion@vmware.com, magnus@hagander.net, stark@mit.edu, sfrost@snowman.net, tgl@sss.pgh.pa.us
  Subject: Re: Proposal: Save user's original authenticated identity for logging
  In-Reply-To: <36ad4829f46a30b16355b60d45f43f89b89dac52.camel@vmware.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox