Date: Sat, 26 Feb 2022 14:39:17 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Andres Freund <andres@anarazel.de>
Cc: Jacob Champion <pchampion@vmware.com>,
	"rjuju123@gmail.com" <rjuju123@gmail.com>,
	"pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>,
	"sfrost@snowman.net" <sfrost@snowman.net>
Subject: Re: [PATCH] Expose port->authn_id to extensions and triggers
Message-ID: <Yhm9BUjrCItExUJu@paquier.xyz>
References: <793d990837ae5c06a558d58d62de9378ab525d83.camel@vmware.com>
 <YhduhD/SvIX5NnxY@paquier.xyz>
 <2e28b12b450f247d5c0994207030c862263e0297.camel@vmware.com>
 <20220224171538.jbf2cxzmhiwuinp4@jrouhaud>
 <a4d9baa0717ca924331cb1dd062788bd73bd14a4.camel@vmware.com>
 <d15d02c92a3e4bdb7cc7b96b0abfe97f213e4445.camel@vmware.com>
 <cdbcf8653e56340f73438e647ea5a26f021627ed.camel@vmware.com>
 <20220225212349.gf76klktl4dmm5ah@alap3.anarazel.de>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="zaOToioJReYXqTrz"
Content-Disposition: inline
In-Reply-To: <20220225212349.gf76klktl4dmm5ah@alap3.anarazel.de>
Archived-At: <https://www.postgresql.org/message-id/Yhm9BUjrCItExUJu%40paquier.xyz>
Precedence: bulk


--zaOToioJReYXqTrz
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Fri, Feb 25, 2022 at 01:23:49PM -0800, Andres Freund wrote:
> Looks to me like authn_id isn't synchronized to parallel workers right now. So
> the function will return the wrong thing when executed as part of a parallel
> query.

FWIW, I am not completely sure what's the use case for being able to
see the authn of the current session through a trigger.  We expose
that when log_connections is enabled, for audit purposes.  I can also
get behind something more central so as one can get a full picture of
the authn used by a bunch of session, particularly with complex HBA
policies, but this looks rather limited to me in usability.  Perhaps
that's not enough to stand as an objection, though, and the patch is
dead simple.

> I don't think we should add further functions not prefixed with pg_.

Yep.

> Perhaps a few tests for less trivial authn_ids could be worthwhile?
> E.g. certificate DNs.

Yes, src/test/ssl would handle that just fine.  Now, this stuff
already looks after authn results with log_connections=on, so that
feels like a duplicate.
--
Michael

--zaOToioJReYXqTrz
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmIZvQUACgkQnvQgOdby
QH1YgxAAgEEur9ugmUNj6/7SvxA536PxHwb+D29ZH7LsCfI6c/oEITgShOSWxpjc
9zzbWnFEl7P6q4Q33N4hOZlGRkkXXEUwAUzb5TKgZ4wtuyVErvtazzKq6kEc5/uJ
BrEyYeblkgTLVsGREwq9z8TIsl+U+ErmAUVzmiXQtvnvlyirdx57IXwgwJ5Hu6Z7
VrLKGoMk9fMDAJYXwLUTi9SAuHy5VNd6Tjjkb0X2Ly141V6LRIYd54XNVfXG+w6a
Pf6uFvgL8iMvfrw6Z5ziKRXjXFzYe1T8M/i8beDSJG/Kn1H3IcqzXJWklFxDu1YJ
KmAQxg6gKHWINbWBeK+8rAzXAjGwdZu31FfD7gNcDI1dJogIXAfNsEln2Qj+QtHw
BB9sSHkvwVz5ytjX7KEir0kym7/Thfvyi4Y2kz8qI/BU7JHbNYwpPgPyUxnjv8vF
1+bzox9A58SwD/H42296hjxMGbxk06Lj+dPD28f6Sgbji+USmjcCnydyOiVIYDr6
q4jgdy4njkR8rVDlOfqQTcFps/XgGfAYTmNJPSHTTZr029vJ3xf4DKSSlwJ5nBPH
01QP5h6D+2WS8hcnI37nbc3rhrvdPx5cgx/SCbvMXoIa3PMVbY1tciQyKJntoFB8
3lGTkRAovm/mWeDQWEfm/4e306vpPm97YyhigUcqyzRKk7ARFZ4=
=vjjr
-----END PGP SIGNATURE-----

--zaOToioJReYXqTrz--