From: Jacob Champion <pchampion@vmware.com>
To: tgl@sss.pgh.pa.us <tgl@sss.pgh.pa.us>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Cc: sfrost@snowman.net <sfrost@snowman.net>
Subject: Re: Proposal: Save user's original authenticated identity for logging
Date: Sat, 30 Jan 2021 00:10:59 +0000
Message-ID: <c6474caf44f21188651a21f23045128816731e30.camel@vmware.com> (raw)
In-Reply-To: <2832058.1611963634@sss.pgh.pa.us>
References: <c55788dd1773c521c862e8e0dddb367df51222be.camel@vmware.com>
<20210129220101.GE27507@tamriel.snowman.net>
<2829030.1611959442@sss.pgh.pa.us>
<c65fd6360d9a174dcf98b1e2e7d02ca654e0ca85.camel@vmware.com>
<2832058.1611963634@sss.pgh.pa.us>
On Fri, 2021-01-29 at 18:40 -0500, Tom Lane wrote:
> Ah. So basically, this comes into play when you consider that some
> outside-the-database entity is your "real" authenticated identity.
> That seems reasonable when using Kerberos or the like, though it's
> not real meaningful for traditional password-type authentication.
Right.
> So, if we store this "real" identity, is there any security issue
> involved in exposing it to other users (via pg_stat_activity or
> whatever)?
I think that could be a concern for some, yeah. Besides being able to
get information on other logged-in users, the ability to connect an
authenticated identity to a username also gives you some insight into
the pg_hba configuration.
--Jacob
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: pchampion@vmware.com, tgl@sss.pgh.pa.us, sfrost@snowman.net
Subject: Re: Proposal: Save user's original authenticated identity for logging
In-Reply-To: <c6474caf44f21188651a21f23045128816731e30.camel@vmware.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox