From: Jacob Champion <pchampion@vmware.com>
To: sfrost@snowman.net <sfrost@snowman.net>
Cc: magnus@hagander.net <magnus@hagander.net>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: Proposal: Save user's original authenticated identity for logging
Date: Mon, 1 Feb 2021 22:40:18 +0000
Message-ID: <c4233543f0941a916ad60f555cfe9d88f9fc0c8c.camel@vmware.com> (raw)
In-Reply-To: <20210201220126.GW27507@tamriel.snowman.net>
References: <c55788dd1773c521c862e8e0dddb367df51222be.camel@vmware.com>
<20210129220101.GE27507@tamriel.snowman.net>
<e5bcc7f6bf9a3bd7751f97e2c34a5b877d3cbe4c.camel@vmware.com>
<CABUevExLkKQFK3un7veD=yoztJO+gnAuAF4RTbdHLF+-pkAfYA@mail.gmail.com>
<20210201164905.GI27507@tamriel.snowman.net>
<57b741e9388f3bd97486615ea1f968c8eee9f055.camel@vmware.com>
<20210201220126.GW27507@tamriel.snowman.net>
On Mon, 2021-02-01 at 17:01 -0500, Stephen Frost wrote:
> * Jacob Champion (pchampion@vmware.com) wrote:
> > And I'm not holding
> > my breath for LDAP servers to start implementing federated identity,
> > though that would be nice.
>
> Not sure exactly what you're referring to here but AD already provides
> Kerberos with cross-domain trusts (aka forests). The future is here..?
> :)
If the end user is actually using LDAP-on-top-of-AD, and comfortable
administering the Kerberos-related pieces of AD so that their *nix
servers and users can speak it instead, then sure. But I continue to
hear about customers who don't fit into that mold. :D Enough that I
have to keep an eye on the "pure" LDAP side of things, at least.
> > To double-check -- since giving this ability to the pg_read_all_stats
> > role would expand its scope -- could that be dangerous for anyone?
>
> I don't agree that this really expands its scope- in fact, you'll see
> that the GSSAPI and SSL user authentication information is already
> allowed under HAS_PGSTAT_PERMISSIONS().
Ah, so they are. :) I think that's the way to go, then.
--Jacob
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: pchampion@vmware.com, sfrost@snowman.net, magnus@hagander.net
Subject: Re: Proposal: Save user's original authenticated identity for logging
In-Reply-To: <c4233543f0941a916ad60f555cfe9d88f9fc0c8c.camel@vmware.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox