X-Original-To: pgsql-interfaces-postgresql.org@localhost.postgresql.org Received: from localhost (av.hub.org [200.46.204.144]) by postgresql.org (Postfix) with ESMTP id E83D99DC93C for ; Mon, 19 Dec 2005 02:08:14 -0400 (AST) Received: from postgresql.org ([200.46.204.71]) by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024) with ESMTP id 61885-01 for ; Mon, 19 Dec 2005 02:08:14 -0400 (AST) X-Greylist: from auto-whitelisted by SQLgrey- Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130]) by postgresql.org (Postfix) with ESMTP id 8566C9DC8DC for ; Mon, 19 Dec 2005 02:08:12 -0400 (AST) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.13.1/8.13.1) with ESMTP id jBJ688IF020254; Mon, 19 Dec 2005 01:08:08 -0500 (EST) To: k.p.d.lehre@medisin.uio.no cc: pgsql-interfaces@postgresql.org Subject: Re: To whom an SSL client crt (postgresql.crt) is issued In-reply-to: <3307.129.240.250.35.1134919026.squirrel@webmail.uio.no> References: <3307.129.240.250.35.1134919026.squirrel@webmail.uio.no> Comments: In-reply-to k.p.d.lehre@medisin.uio.no message dated "Sun, 18 Dec 2005 16:17:06 +0100" Date: Mon, 19 Dec 2005 01:08:08 -0500 Message-ID: <20253.1134972488@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: by amavisd-new at hub.org X-Spam-Status: No, score=0.016 required=5 tests=[AWL=0.016] X-Spam-Score: 0.016 X-Spam-Level: X-Archive-Number: 200512/32 X-Sequence-Number: 5900 k.p.d.lehre@medisin.uio.no writes: > The docs do not mention that the client crt has to be issued > to the user trying to log on. Isn't it a point TO WHOM the client crt is > issued? Is this the way it is meant to be? Restricting that would require assumptions-not-in-evidence about certificate issuers using names that sync with database user names. But perhaps more to the point, Postgres does not use SSL certificates as a user authentication mechanism, only as a transport privacy mechanism. Using SSL is not sufficient grounds for deciding you can use "trust" auth mode. regards, tom lane