From: Jacob Champion <pchampion@vmware.com>
To: tgl@sss.pgh.pa.us <tgl@sss.pgh.pa.us>
To: sfrost@snowman.net <sfrost@snowman.net>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: Proposal: Save user's original authenticated identity for logging
Date: Fri, 29 Jan 2021 23:33:02 +0000
Message-ID: <c65fd6360d9a174dcf98b1e2e7d02ca654e0ca85.camel@vmware.com> (raw)
In-Reply-To: <2829030.1611959442@sss.pgh.pa.us>
References: <c55788dd1773c521c862e8e0dddb367df51222be.camel@vmware.com>
<20210129220101.GE27507@tamriel.snowman.net>
<2829030.1611959442@sss.pgh.pa.us>
On Fri, 2021-01-29 at 17:30 -0500, Tom Lane wrote:
> What happens if ALTER USER RENAME is done while the session is still
> alive?
IMO the authenticated identity should be write-once. Especially since
one of my goals is to have greater auditability into events as they've
actually happened. So ALTER USER RENAME should have no effect.
This also doesn't really affect third-party auth methods. If I'm bound
as pchampion@EXAMPLE.COM and a superuser changes my username to tlane,
you _definitely_ don't want to see my authenticated identity change to
tlane@EXAMPLE.COM. That's not who I am.
So the potential confusion would come into play with first-party authn.
From an audit perspective, I think it's worth it. I did authenticate as
pchampion, not tlane.
> More generally, exposing this in log_line_prefix seems like an awfully
> narrow-minded view of what people will want it for. I'd personally
> think pg_stat_activity a better place to look, for example.
> [...]
> Yeah, this seems like about the most expensive way that we could possibly
> choose to make the info available.
I'm happy as long as it's _somewhere_. :D It's relatively easy to
expose a single location through multiple avenues, but currently there
is no single location.
--Jacob
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: pchampion@vmware.com, tgl@sss.pgh.pa.us, sfrost@snowman.net
Subject: Re: Proposal: Save user's original authenticated identity for logging
In-Reply-To: <c65fd6360d9a174dcf98b1e2e7d02ca654e0ca85.camel@vmware.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox