public inbox for [email protected]  
help / color / mirror / Atom feed
From: Jacob Champion <[email protected]>
To: [email protected] <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: [PATCH] Support pg_ident mapping for LDAP
Date: Tue, 28 Sep 2021 18:02:38 +0000
Message-ID: <[email protected]> (raw)
In-Reply-To: <CABUevEx37JeUPnVztm-Kcx1CF9rTfUZyu6U3QmBD6-_FYi93og@mail.gmail.com>
References: <[email protected]>
	<[email protected]>
	<[email protected]>
	<CABUevEx37JeUPnVztm-Kcx1CF9rTfUZyu6U3QmBD6-_FYi93og@mail.gmail.com>

On Tue, 2021-09-28 at 15:38 +0200, Magnus Hagander wrote:
> I'm a bit hesitant about the ldapuser libpq parameter. Do we really
> want to limit ourselves to just ldap, if we allow this? I mean, why
> not allow say radius or pam to also specify a different username for
> the external system? If we want to do that, now or in the future, we
> should have a much more generic parameter name, something like
> authuser?

I'd be on board with a more general option name.

So from the perspective of a SASL exchange, PGUSER would be the
authorization identity, and PGAUTHUSER, say, would be the
authentication identity. Is "auth" a clear enough prefix that users and
devs will understand what the difference is between the two?

         | authn             authz
---------+-----------------------------------
  envvar | PGAUTHUSER        PGUSER
conninfo | authuser          user
frontend | conn->pgauthuser  conn->pguser backend | port->auth_user   port->user_name

> Why do we actually need ldap_map_dn? Shouldn't this just be what
> happens if you specify map= on an ldap connection?

For simple-bind setups, I think requiring users to match an entire DN
is probably unnecessary (and/or dangerous once you start getting into
regex mapping), so the map uses the bare username by default. My intent
was for that to have the same default behavior as cert maps.

Thanks,
--Jacob


view thread (12+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: [PATCH] Support pg_ident mapping for LDAP
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox