From: Jacob Champion <pchampion@vmware.com>
To: magnus@hagander.net <magnus@hagander.net>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Cc: sfrost@snowman.net <sfrost@snowman.net>
Subject: Re: Proposal: Save user's original authenticated identity for logging
Date: Mon, 1 Feb 2021 21:36:34 +0000
Message-ID: <94f6b945f9ca8cabe2b9d2a38ec19dca6f90a083.camel@vmware.com> (raw)
In-Reply-To: <CABUevExLkKQFK3un7veD=yoztJO+gnAuAF4RTbdHLF+-pkAfYA@mail.gmail.com>
References: <c55788dd1773c521c862e8e0dddb367df51222be.camel@vmware.com>
<20210129220101.GE27507@tamriel.snowman.net>
<e5bcc7f6bf9a3bd7751f97e2c34a5b877d3cbe4c.camel@vmware.com>
<CABUevExLkKQFK3un7veD=yoztJO+gnAuAF4RTbdHLF+-pkAfYA@mail.gmail.com>
On Sun, 2021-01-31 at 12:27 +0100, Magnus Hagander wrote:
> > (There's also the fact that I think pg_ident mapping for LDAP would be
> > just as useful as it is for GSS or certs. That's for a different
> > conversation.)
>
> Specifically for search+bind, I would assume?
Even for the simple bind case, I think it'd be useful to be able to
perform a pg_ident mapping of
ldapmap /.* ldapuser
so that anyone who is able to authenticate against the LDAP server is
allowed to assume the ldapuser role. (For this to work, you'd need to
be able to specify your LDAP username as a connection option, similar
to how you can specify a client certificate, so that you could set
PGUSER=ldapuser.)
But again, that's orthogonal to the current discussion.
> With that I think it would also be useful to have it available in the
> system as well -- either as a column in pg_stat_activity or maybe just
> as a function like pg_get_authenticated_identity() since it might be
> something that's interesting to a smallish subset of users (but very
> interesting to those).
Agreed, it would slot in nicely with the other per-backend stats functions.
--Jacob
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: pchampion@vmware.com, magnus@hagander.net, sfrost@snowman.net
Subject: Re: Proposal: Save user's original authenticated identity for logging
In-Reply-To: <94f6b945f9ca8cabe2b9d2a38ec19dca6f90a083.camel@vmware.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox