From: Andrew Dunstan <andrew@dunslane.net>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Superuser can permit passwordless connections on postgres_fdw
Date: Fri, 20 Dec 2019 05:55:10 +0000
Message-ID: <E1iiBFm-0001RN-N2@gemulon.postgresql.org> (raw)
Superuser can permit passwordless connections on postgres_fdw
Currently postgres_fdw doesn't permit a non-superuser to connect to a
foreign server without specifying a password, or to use an
authentication mechanism that doesn't use the password. This is to avoid
using the settings and identity of the user running Postgres.
However, this doesn't make sense for all authentication methods. We
therefore allow a superuser to set "password_required 'false'" for user
mappings for the postgres_fdw. The superuser must ensure that the
foreign server won't try to rely solely on the server identity (e.g.
trust, peer, ident) or use an authentication mechanism that relies on the
password settings (e.g. md5, scram-sha-256).
This feature is a prelude to better support for sslcert and sslkey
settings in user mappings.
Author: Craig Ringer.
Discussion: https://postgr.es/m/075135da-545c-f958-fed0-5dcb462d6dae@2ndQuadrant.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/6136e94dcb88c50b6156aa646746565400e373d4
Modified Files
--------------
contrib/postgres_fdw/connection.c | 42 +++++++++---
contrib/postgres_fdw/expected/postgres_fdw.out | 94 ++++++++++++++++++++++++++
contrib/postgres_fdw/option.c | 19 ++++++
contrib/postgres_fdw/sql/postgres_fdw.sql | 86 +++++++++++++++++++++++
doc/src/sgml/postgres-fdw.sgml | 24 +++++++
5 files changed, 257 insertions(+), 8 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: andrew@dunslane.net, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Superuser can permit passwordless connections on postgres_fdw
In-Reply-To: <E1iiBFm-0001RN-N2@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox