Feedback-ID: i0fe9450f:Fastmail
Date: Wed, 15 Feb 2023 16:11:08 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Jelte Fennema <postgres@jeltef.nl>
Cc: Pavel Luzanov <p.luzanov@postgrespro.ru>,
	Jelte Fennema <Jelte.Fennema@microsoft.com>,
	"isaac.morland@gmail.com" <isaac.morland@gmail.com>,
	"pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>,
	Nathan Bossart <nathandbossart@gmail.com>,
	Andrew Dunstan <andrew@dunslane.net>
Subject: Re: [EXTERNAL] Re: [PATCH] Support using "all" for the db user in
 pg_ident.conf
Message-ID: <Y+yFjA16V+g4L+mO@paquier.xyz>
References: <CAGECzQQ_h_-kUg_xy=mm8b6wQ=TSMV=-5h37T32=qODxi+GOMA@mail.gmail.com>
 <Y8TfE699nFya24fp@paquier.xyz>
 <CAGECzQTuW=JwY6-eVRXMxP=_UeH7K_asAOOXXH8-1fHGm-Gbsg@mail.gmail.com>
 <Y8YtunC3vL+sfr4r@paquier.xyz>
 <CAGECzQQb_4zM8VPshrNbBjtGRdGxMiTDCTdCAaDjGuUR7+=itw@mail.gmail.com>
 <Y8j3lU6hB2jJjWm6@paquier.xyz>
 <CAGECzQTmtOQ+72nWecMEORVHQa_kWb=UMX++tPTOTtdVxb=j+g@mail.gmail.com>
 <Y8n7vWWA+IlFwtb8@paquier.xyz>
 <e495112d-8741-e651-64a2-ecb5728f1a56@postgrespro.ru>
 <CAGECzQRXzWF8GzCOqUWb0qiRn+hxNF1BQEwSVvrUMeVLhOPo6g@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="s9bzwfoXXqgLuDsI"
Content-Disposition: inline
In-Reply-To: <CAGECzQRXzWF8GzCOqUWb0qiRn+hxNF1BQEwSVvrUMeVLhOPo6g@mail.gmail.com>
Archived-At: <https://www.postgresql.org/message-id/Y%2ByFjA16V%2Bg4L%2BmO%40paquier.xyz>
Precedence: bulk


--s9bzwfoXXqgLuDsI
Content-Type: multipart/mixed; boundary="0Lx/PKXfiRU35P3g"
Content-Disposition: inline


--0Lx/PKXfiRU35P3g
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Feb 13, 2023 at 03:13:04PM +0100, Jelte Fennema wrote:
> On Mon, 13 Feb 2023 at 15:06, Pavel Luzanov <p.luzanov@postgrespro.ru> wr=
ote:
>> Does it make sense to reflect changes to the PG-USERNAME field in the
>> pg_ident.conf.sample file?
>>
>> The same relates to the regexp supportin the DATABASE and USER fieldsof
>> the pg_hba.conf.sample file(8fea8683).

Which comes down to blame me for both of them.

> That definitely makes sense to me. When writing the patch I didn't
> realise that there was also documentation in those files.
>=20
> I think it also makes sense to include usage of (some of) the features
> in the example files here:
> https://www.postgresql.org/docs/devel/auth-username-maps.html

Hmm, I am not sure that adding more examples in the sample files is
worth the duplication with the docs.

So, please find attached a patch to close the gap the sample files,
for both things, with descriptions of all the field values they can
use.

What do you think?
--
Michael

--0Lx/PKXfiRU35P3g
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename="sample-descriptions.patch"

diff --git a/src/backend/libpq/pg_hba.conf.sample b/src/backend/libpq/pg_hba.conf.sample
index 095e3b4cc0..fc448b5b7e 100644
--- a/src/backend/libpq/pg_hba.conf.sample
+++ b/src/backend/libpq/pg_hba.conf.sample
@@ -31,14 +31,15 @@
 # - "hostnogssenc" is a TCP/IP socket that is not GSSAPI-encrypted
 #
 # DATABASE can be "all", "sameuser", "samerole", "replication", a
-# database name, or a comma-separated list thereof. The "all"
-# keyword does not match "replication". Access to replication
-# must be enabled in a separate record (see example below).
+# database name, a regular expression (if it starts with a slash (/))
+# or a comma-separated list thereof.  The "all" keyword does not match
+# "replication". Access to replication must be enabled in a separate
+# record (see example below).
 #
-# USER can be "all", a user name, a group name prefixed with "+", or a
-# comma-separated list thereof.  In both the DATABASE and USER fields
-# you can also write a file name prefixed with "@" to include names
-# from a separate file.
+# USER can be "all", a user name, a group name prefixed with "+", a
+# regular expression (if it starts with a slash (/)) or a comma-separated
+# list thereof.  In both the DATABASE and USER fields you can also write
+# a file name prefixed with "@" to include names from a separate file.
 #
 # ADDRESS specifies the set of hosts the record matches.  It can be a
 # host name, or it is made up of an IP address and a CIDR mask that is
diff --git a/src/backend/libpq/pg_ident.conf.sample b/src/backend/libpq/pg_ident.conf.sample
index 5d32684b28..f5225f26cd 100644
--- a/src/backend/libpq/pg_ident.conf.sample
+++ b/src/backend/libpq/pg_ident.conf.sample
@@ -29,6 +29,10 @@
 # will be substituted for \1 (backslash-one) if present in
 # PG-USERNAME.
 #
+# PG-USERNAME can be "all", a user name, a group name prefixed with "+", or
+# a regular expression (if it starts with a slash (/)).  If it is a regular
+# expression, the substring matching with \1 has no effect.
+#
 # Multiple maps may be specified in this file and used by pg_hba.conf.
 #
 # No map names are defined in the default configuration.  If all

--0Lx/PKXfiRU35P3g--

--s9bzwfoXXqgLuDsI
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmPshYwACgkQnvQgOdby
QH30VA/9Gpq+7LLVrHLJCrVvHo1FHM4Lx1gvFwImaETWqhiPb5P5hZ6xhHuRLgcx
7u4J8C3Tcf76wLeXn0jcMKiqRxdOBk9p1M3PGLTpebxDXbuvjg9n3becD7G8QWHO
M7Q6eGBOzqn2ZQr5IknCfo7yOq1+25tVlNOJNLbzmcxD2mioAzLEFgaJ6kbJN6us
Q2RycSp/9cK8cYNCmcbcgXngwVGanW6WSFgCD3lZ8rOiqWn4ZkTc+JhJh7uL1mXH
zkJJnt/rfJGKV5GHvWLMzjUpCVkYbDHLVNzxGJlyBal0QI4s9sPnPq/6OCkDbPJ7
U6VMNv3BTHeQLQ7YYre6O+LKo99uWtZQjMNlROVKcH1y7732adsCtIztZmKAFu81
LPW1JcETM/S6+I3o0o77sVCoLZHcOx2Jc7gnZArxqfs5Au2nxIIP6rZuv3O0/pJh
/8feKolKIKh7qlbW+uV1yi4/RVkGx3znibL511lg1aSDDwmvTmHwwpbTL7D1D0RT
8gOWhpqFdcXCxykK4V7DWh8dVa2YL5Vfmm0wEwwm9IDmRVCJkDWj6aKU9l3JN8eg
1P/UEiQGi45GTzC7gArgU1i+GPwUBEjdFSvDCqAlr6JT2VIB8HeEowsLVPLJq69v
TewaHm8MH+kX/dqCSO+OSVSAZpipNVg6g3lY/2/mjyMVZBgB4T0=
=Zfh+
-----END PGP SIGNATURE-----

--s9bzwfoXXqgLuDsI--