From: Tom Lane <tgl@sss.pgh.pa.us>
To: k.p.d.lehre@medisin.uio.no
Cc: pgsql-interfaces@postgresql.org
Subject: Re: To whom an SSL client crt (postgresql.crt) is issued
Date: Mon, 19 Dec 2005 01:08:08 -0500
Message-ID: <20253.1134972488@sss.pgh.pa.us> (raw)
In-Reply-To: <3307.129.240.250.35.1134919026.squirrel@webmail.uio.no>
References: <3307.129.240.250.35.1134919026.squirrel@webmail.uio.no>
k.p.d.lehre@medisin.uio.no writes:
> The docs do not mention that the client crt has to be issued
> to the user trying to log on. Isn't it a point TO WHOM the client crt is
> issued? Is this the way it is meant to be?
Restricting that would require assumptions-not-in-evidence about
certificate issuers using names that sync with database user names.
But perhaps more to the point, Postgres does not use SSL certificates
as a user authentication mechanism, only as a transport privacy
mechanism. Using SSL is not sufficient grounds for deciding you
can use "trust" auth mode.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: tgl@sss.pgh.pa.us, k.p.d.lehre@medisin.uio.no
Subject: Re: To whom an SSL client crt (postgresql.crt) is issued
In-Reply-To: <20253.1134972488@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox