pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Jacob Champion <pchampion@vmware.com>
To: sfrost@snowman.net <sfrost@snowman.net>
Cc: magnus@hagander.net <magnus@hagander.net>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: Proposal: Save user's original authenticated identity for logging
Date: Tue, 2 Feb 2021 00:16:47 +0000
Message-ID: <90b476785eb6b2744a578ff47db5b4b7949dd11b.camel@vmware.com> (raw)
In-Reply-To: <20210201234013.GD27507@tamriel.snowman.net>
References: <c55788dd1773c521c862e8e0dddb367df51222be.camel@vmware.com>
	<20210129220101.GE27507@tamriel.snowman.net>
	<e5bcc7f6bf9a3bd7751f97e2c34a5b877d3cbe4c.camel@vmware.com>
	<CABUevExLkKQFK3un7veD=yoztJO+gnAuAF4RTbdHLF+-pkAfYA@mail.gmail.com>
	<20210201164905.GI27507@tamriel.snowman.net>
	<57b741e9388f3bd97486615ea1f968c8eee9f055.camel@vmware.com>
	<20210201220126.GW27507@tamriel.snowman.net>
	<c4233543f0941a916ad60f555cfe9d88f9fc0c8c.camel@vmware.com>
	<20210201230146.GY27507@tamriel.snowman.net>
	<12d26c8e9e3c9526a7b9e191513a8d948f31bbbe.camel@vmware.com>
	<20210201234013.GD27507@tamriel.snowman.net>

On Mon, 2021-02-01 at 18:40 -0500, Stephen Frost wrote:
> * Jacob Champion (pchampion@vmware.com) wrote:
> > My goal is to get this one single point of reference, for all of the
> > auth backends. The LDAP mapping conversation is separate.
> 
> Presumably this would be the DN for SSL then..?  Not just the CN?

Correct.

> How would the issuer DN be included?  And the serial?

In the current proposal, they're not. Seems like only the Subject
should be considered when determining the "identity of the user" --
knowing the issuer or the certificate fingerprint might be useful in
general, and perhaps they should be logged somewhere, but they're not
part of the user's identity.

If there were a feature that considered the issuer or serial number
when making role mappings, I think it'd be easier to make a case for
that. As of right now I don't think they should be incorporated into
this *particular* identifier.

--Jacob


view thread (80+ messages)  latest in thread

Message-ID: <90b476785eb6b2744a578ff47db5b4b7949dd11b.camel@vmware.com>
Permalink:  ../90b476785eb6b2744a578ff47db5b4b7949dd11b.camel@vmware.com/
Also on:    postgresql.org/message-id/90b476785eb6b2744a578ff47db5b4b7949dd11b.camel@vmware.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: pchampion@vmware.com, sfrost@snowman.net, magnus@hagander.net
  Subject: Re: Proposal: Save user's original authenticated identity for logging
  In-Reply-To: <90b476785eb6b2744a578ff47db5b4b7949dd11b.camel@vmware.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox