agora inbox for pgsql-sql@postgresql.org
help / color / mirror / Atom feedFrom: Tom Lane <tgl@sss.pgh.pa.us>
To: Jonathan Katz <jonathan.katz@excoventures.com>
Cc: aditya desai <admad123@gmail.com>
Cc: pgsql-sql <pgsql-sql@lists.postgresql.org>
Subject: Re: Pragma autonomous transactions in Postgres/ Certification based authentication in DB Links
Date: Fri, 17 Dec 2021 11:27:30 -0500
Message-ID: <1355149.1639758450@sss.pgh.pa.us> (raw)
In-Reply-To: <A0E82030-D418-4596-A6E5-87016B0CCCE7@excoventures.com>
References: <CAN0SRDEGsXnULFzB+X7FNzwO4iT27G=rDhe9GgvMnhsj98KKPw@mail.gmail.com>
<A0E82030-D418-4596-A6E5-87016B0CCCE7@excoventures.com>
Jonathan Katz <jonathan.katz@excoventures.com> writes:
>> On Dec 17, 2021, at 10:43 AM, aditya desai <admad123@gmail.com> wrote:
>> How to use certificate based authentication in DB Links instead of hardcoding user name and password in it?
> dblink lets you pass in a PostgreSQL connection string[1].
> From there you can reference parameters to use certificates[2].
No, that won't help. Like postgres_fdw, dblink will only let you use
non-password auth methods if you're superuser [1][2]. The problem is
that making use of any credentials stored in the server's filesystem
amounts to impersonating the OS user that's running the server. It'd
be nice to find a less confining solution, but I'm not sure what one
would look like.
Maybe "use server's FDW credentials" could be associated with a
grantable role? That's still an awfully coarse-grained approach
though. I thought for a moment about putting an SSL cert right
into the connection string; but you'd have to put the SSL private
key in there too, making it just as much of a security problem as
putting a password there (but about 100 times more verbose :-().
regards, tom lane
[1] https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=contrib/dblink/dblink.c;h=d73c616f4f240...
[2] https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=contrib/dblink/dblink.c;h=d73c616f4f240...
view thread (8+ messages) latest in thread
Message-ID: <1355149.1639758450@sss.pgh.pa.us>
Permalink: ../1355149.1639758450@sss.pgh.pa.us/
Also on: postgresql.org/message-id/1355149.1639758450@sss.pgh.pa.us
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: tgl@sss.pgh.pa.us, jonathan.katz@excoventures.com, admad123@gmail.com, pgsql-sql@lists.postgresql.org
Subject: Re: Pragma autonomous transactions in Postgres/ Certification based authentication in DB Links
In-Reply-To: <1355149.1639758450@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox