Feedback-ID: i0fe9450f:Fastmail
Date: Thu, 12 Jan 2023 14:32:15 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Jelte Fennema <postgres@jeltef.nl>
Cc: Jelte Fennema <Jelte.Fennema@microsoft.com>,
	"isaac.morland@gmail.com" <isaac.morland@gmail.com>,
	"pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>,
	Nathan Bossart <nathandbossart@gmail.com>,
	Andrew Dunstan <andrew@dunslane.net>
Subject: Re: [EXTERNAL] Re: [PATCH] Support using "all" for the db user in
 pg_ident.conf
Message-ID: <Y7+bXzP5ubRHgoyf@paquier.xyz>
References: <DBBPR83MB0507FEC2E8965012990A80D0F7FC9@DBBPR83MB0507.EURPRD83.prod.outlook.com>
 <Y76YEHolPL4LIAtO@paquier.xyz>
 <CAGECzQTkwELHUOAKhvdA+m3tWbUQySHHkExJV8GAZ1pwgbEgXg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="Xv5kc6hmXPJv+ky2"
Content-Disposition: inline
In-Reply-To: <CAGECzQTkwELHUOAKhvdA+m3tWbUQySHHkExJV8GAZ1pwgbEgXg@mail.gmail.com>
Archived-At: <https://www.postgresql.org/message-id/Y7%2BbXzP5ubRHgoyf%40paquier.xyz>
Precedence: bulk


--Xv5kc6hmXPJv+ky2
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Wed, Jan 11, 2023 at 03:22:35PM +0100, Jelte Fennema wrote:
> The main uncertainty I have is if the case insensitivity check is
> actually needed in check_role. It seems like a case insensitive
> check against the database user shouldn't actually be necessary.
> I only understand the need for the case insensitive check against
> the system user. But I have too little experience with LDAP/kerberos
> to say for certain. So for now I kept the existing behaviour to
> not regress.

                if (!identLine->pg_user->quoted &&
+                       identLine->pg_user->string[0] != '+' &&
+                       !token_is_keyword(identLine->pg_user, "all") &&
+                       !token_has_regexp(identLine->pg_user) &&
If we finish by allowing a regexp for the PG user in an IdentLine, I
would choose to drop "all" entirely.  Simpler is better when it comes
to authentication, though we are working on getting things more..
Complicated.

+   Quoting a <replaceable>database-username</replaceable> containing
+   <literal>\1</literal> makes the <literal>\1</literal>
+   lose its special meaning.
0002 and 0003 need careful thinking.

+# Success as the regular expression matches and \1 is replaced
+reset_pg_ident($node, 'mypeermap', qq{/^$system_user(.*)\$},
+       'test\1mapuser');
+test_role(
+       $node,
+       qq{testmapuser},
+       'peer',
+       0,
+       'with regular expression in user name map with \1',
+       log_like =>
+         [qr/connection authenticated: identity="$system_user" method=peer/]);
Relying on kerberos to check the substitution pattern is a bit
annoying..  I would be really tempted to extract and commit that
independently of the rest, actually, to provide some coverage of the
substitution case in the peer test.

> The patchset also contains 3 preparatory patches with two refactoring
> passes and one small bugfix + test additions.

Applied 0001, which looked fine and was an existing issue.  At the
end, I had no issues with the names you suggested.
--
Michael

--Xv5kc6hmXPJv+ky2
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmO/m18ACgkQnvQgOdby
QH1ENA/+NSIQJ0/Z2XuYcc1gMR1YyK6vBogAmXvlvREZo+imt/J+o5t60ni3PXFX
+vDZVHoVZWmfOLvWP+JfZeqR36eInLkN925vCk1yOq4Mu1RZNIOAGtv09Y8sPGVZ
2WqPNv1SPyKCQXmlP8VLi/ylkn8Vl8fCIWXQx9SwBkC0rmOY2eaocsyIeqviqUVh
HVrqs9qT7rA/p4XlsdmWMo4SGCVfG9pM/LGMgY2i+yGHjwuHmqoXYFbpzQv1IElj
klHaVchi0CZzaIg4vjI95r1G/ulI4ciRXprMCJ4Qq4+BX9+xACm22kggMLgB1QgQ
+rTrU1JJgidLzvxDHbXm/hMIkiqIvZ//ramAcGQO2F7tVaAuLpDmPV5JKBO/O+Nh
1vL4Eazkwu64N+EFlhSDxiGQwzuZTdTYi9aLv0BWGwVKB+DrY9EFR9ceGnesAlKU
DXAQu3Gafyr0ZYWalBfd/+OYamAWrbNs0zmpl/ZqnC/7ZY+YPnGaHScMyI3TLDWl
pQpFugIAoxbojAAA6ftnjcoPhU/cQQC+3Q1pTGs8q3ivG8zcCNsp0m+5Npt0HURx
O3/Km8D5aStgR6iSKToRRK8jCHPyqIUOhKItr/9HEIey/+fp1Q0LOcAF6Fvluh2U
/Bgq47C2NKRNOEAV7glefzT0BYRxE4lozZB/8ryIsSyAaXwsbVI=
=mj8k
-----END PGP SIGNATURE-----

--Xv5kc6hmXPJv+ky2--