Subject: Re: [EXTERNAL] Re: [PATCH] Support using "all" for the db user in pg_ident.conf

From: Jelte Fennema <[email-masked]>
Date: Thu, 19 Jan 2023 12:23:16 +0100

Looks good to me. One tiny typo in a comment that I noticed when going
over the diff:

+            * Mark the token as quoted, so it will only be compared literally
+            * and not for some special meaning, such as "all" or a group
+            * membership checks.

should be either:
1. a group membership check
2. group membership checks

Now it's mixed singular and plural.

---

From: Michael Paquier <[email-masked]>
Date: Fri, 20 Jan 2023 11:26:05 +0900

> Now it's mixed singular and plural.

Thanks, fixed.  And now applied the last patch.
--
Michael

---

From: Pavel Luzanov <[email-masked]>
Date: Mon, 13 Feb 2023 17:06:02 +0300

Hello,

Playing with this patch, I did not see descriptive comments in 
pg_ident.conf.

Does it make sense to reflect changes to the PG-USERNAME field in the 
pg_ident.conf.sample file?

The same relates to the regexp supportin the DATABASE and USER fieldsof 
the pg_hba.conf.sample file(8fea8683).

-----
Pavel Luzanov

---

From: Jelte Fennema <[email-masked]>
Date: Mon, 13 Feb 2023 15:13:04 +0100

> the pg_hba.conf.sample file(8fea8683).

That definitely makes sense to me. When writing the patch I didn't
realise that there was also documentation in those files.

I think it also makes sense to include usage of (some of) the features
in the example files here:
https://www.postgresql.org/docs/devel/auth-username-maps.html

---

From: Michael Paquier <[email-masked]>
Date: Wed, 15 Feb 2023 16:11:08 +0900

>> the pg_hba.conf.sample file(8fea8683).

Which comes down to blame me for both of them.

> https://www.postgresql.org/docs/devel/auth-username-maps.html

Hmm, I am not sure that adding more examples in the sample files is
worth the duplication with the docs.

So, please find attached a patch to close the gap the sample files,
for both things, with descriptions of all the field values they can
use.

What do you think?
--
Michael
diff --git a/src/backend/libpq/pg_hba.conf.sample b/src/backend/libpq/pg_hba.conf.sample
index 095e3b4cc0..fc448b5b7e 100644
--- a/src/backend/libpq/pg_hba.conf.sample
+++ b/src/backend/libpq/pg_hba.conf.sample
@@ -31,14 +31,15 @@
 # - "hostnogssenc" is a TCP/IP socket that is not GSSAPI-encrypted
 #
 # DATABASE can be "all", "sameuser", "samerole", "replication", a
-# database name, or a comma-separated list thereof. The "all"
-# keyword does not match "replication". Access to replication
-# must be enabled in a separate record (see example below).
+# database name, a regular expression (if it starts with a slash (/))
+# or a comma-separated list thereof.  The "all" keyword does not match
+# "replication". Access to replication must be enabled in a separate
+# record (see example below).
 #
-# USER can be "all", a user name, a group name prefixed with "+", or a
-# comma-separated list thereof.  In both the DATABASE and USER fields
-# you can also write a file name prefixed with "@" to include names
-# from a separate file.
+# USER can be "all", a user name, a group name prefixed with "+", a
+# regular expression (if it starts with a slash (/)) or a comma-separated
+# list thereof.  In both the DATABASE and USER fields you can also write
+# a file name prefixed with "@" to include names from a separate file.
 #
 # ADDRESS specifies the set of hosts the record matches.  It can be a
 # host name, or it is made up of an IP address and a CIDR mask that is
diff --git a/src/backend/libpq/pg_ident.conf.sample b/src/backend/libpq/pg_ident.conf.sample
index 5d32684b28..f5225f26cd 100644
--- a/src/backend/libpq/pg_ident.conf.sample
+++ b/src/backend/libpq/pg_ident.conf.sample
@@ -29,6 +29,10 @@
 # will be substituted for \1 (backslash-one) if present in
 # PG-USERNAME.
 #
+# PG-USERNAME can be "all", a user name, a group name prefixed with "+", or
+# a regular expression (if it starts with a slash (/)).  If it is a regular
+# expression, the substring matching with \1 has no effect.
+#
 # Multiple maps may be specified in this file and used by pg_hba.conf.
 #
 # No map names are defined in the default configuration.  If all

---

From: Pavel Luzanov <[email-masked]>
Date: Wed, 15 Feb 2023 13:05:04 +0300

> Which comes down to blame me for both of them.

My only intention was to make postgres better.I'm sorry you took it that 
way.

> for both things, with descriptions of all the field values they can

A short and precise description. Nothing to add.Next time I will try to 
offer a patch at once.

-----
Pavel Luzanov

---

From: Michael Paquier <[email-masked]>
Date: Wed, 15 Feb 2023 19:25:59 +0900

> My only intention was to make postgres better.I'm sorry you took it that

You have no need to feel sorry about that.  I really appreciate that
you took the time to report this issue, so don't worry.  My point is
that I have committed this code, so basically it is my responsibility
to take care of its maintenance.

> A short and precise description. Nothing to add.Next time I will try to

If you have a proposal of patch, that's always nice to have, but you
should not feel obliged to do so, either.

Thanks a lot for the report, Pavel!
--
Michael