Message-ID: <54CD3380.7090400@agliodbs.com>
Date: Sat, 31 Jan 2015 11:56:48 -0800
From: Josh Berkus <josh@agliodbs.com>
Organization: PostgreSQL Experts Inc.
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:31.0) Gecko/20100101 Thunderbird/31.3.0
MIME-Version: 1.0
To: Amit Kapila <amit.kapila16@gmail.com>, Robert Haas <robertmhaas@gmail.com>
CC: Jim Nasby <Jim.Nasby@bluetreble.com>, =?UTF-8?B?RmFicsOtemlvIE1lbGxv?=
 <fabriziomello@gmail.com>, Tom Lane <tgl@sss.pgh.pa.us>,
 Haribabu Kommi <kommi.haribabu@gmail.com>,
 Abhijit Menon-Sen <ams@2ndquadrant.com>,
 "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>,
 "Prabakaran, Vaishnavi" <vaishnavip@fast.au.fujitsu.com>,
 Magnus Hagander <magnus@hagander.net>,
 Jaime Casanova <jaime@2ndquadrant.com>
Subject: Re: Providing catalog view to pg_hba.conf file - Patch
 submission
References: <F40B0968DB0A904DA78A924E633BE78645FE29@SYDEXCHTMP2.au.fjanz.com>
	<82897A1301080E4B8E461DDAA0FFCF14DDE1@SYD1216>
	<82897A1301080E4B8E461DDAA0FFCF14FD6E@SYD1216>
	<20140629165554.GA5984@toroid.org>	<20140630070646.GY31357@toroid.org>
	<CAJrrPGe3sZWKFfsHDCJMXfBOqkf6_w6R_DpsUYn2vQK_tVeU1g@mail.gmail.com>
	<54C8156E.1080500@BlueTreble.com>
	<CAJrrPGcFk9_svvipFJeLBrVJYOmq6uNy38NsT8jtfo6Bks5RYw@mail.gmail.com>
	<CAFcNs+oOYYd5k6oE_YyE=AsW2zR0DwvBdjK2PDLQiip53Y0CiA@mail.gmail.com>
	<5661.1422473223@sss.pgh.pa.us>
	<CAFcNs+qHV_qMUxT2ebduLetzRoagMg=7Z_zk1ivQQ5s1y-ZVeQ@mail.gmail.com>
	<54CAAA34.8090302@BlueTreble.com>
	<CAA4eK1LYiaNvJczX4rropqm3o4YK=p_BJPYAX440Arn-FK7HEA@mail.gmail.com>
	<CA+TgmobYrje7A9UQoZB-2gnGXEs5KxzZtB-QbMR_kdt_g84b2g@mail.gmail.com>
 <CAA4eK1Kq_K8tBB9QbyRHN5bVNLL6Ug9uOsXTQOe-pkdPzqLpFQ@mail.gmail.com>
 <WM!0990dade676b8bc88c1e15bcfadbb60ae9a433792650b531854f83f7891c1ae892281408058d7fb8ac551eb4ec6aaf0c!@asav-3.01.com>
In-Reply-To: 
 <WM!0990dade676b8bc88c1e15bcfadbb60ae9a433792650b531854f83f7891c1ae892281408058d7fb8ac551eb4ec6aaf0c!@asav-3.01.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On 01/30/2015 10:01 PM, Amit Kapila wrote:
> On Fri, Jan 30, 2015 at 10:58 PM, Robert Haas <robertmhaas@gmail.com
> <mailto:robertmhaas@gmail.com>> wrote:
>> Yes.  The contents of postgresql.conf are only mildly order-dependent.
>> If you put the same setting in more than once, it matters which one is
>> last.  Apart from that, though, it doesn't really matter:
>> wal_keep_segments=10 means the same thing if it occurs before
>> max_connections=401 that it means after that.  The same is not true of
>> pg_hba.conf, where the order matters a lot.  
> 
> Do you mean to say that as authentication system uses just the
> first record that matches to perform authentication, it could lead
> to problems if an order is not maintained?  Won't the same
> set of problems can occur if user tries to that manually and do
> it without proper care of such rules.  Now the problem with
> command is that user can't see the order in which entries are
> being made, but it seems to me that we can provide a view or some
> way to user so that the order of entries is visible and the same is
> allowed to be manipulated via command.

We *can*, yes.  But the technical issues around that have not been
addressed.  Certainly just making the new system view respond to
UPDATE/INSERT/DELETE would not be sufficient.

And then once we address the technical issues, we'll need to address the
security implications.

I think this is worth doing; there's some tremendous utility potential
in having a PostgresQL which can be 100% managed via port 5432,
especially for the emerging world of container-based hosting (Docker et.
al.).  However, it's also going to be difficult.

-- 
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers