Thread: Authentication problem
Hi there colleagues, From the Docs (Admin 4.1): There is no "fall-through" or "backup": if one record is chosen and the authentication fails, the following records are not considered. Are there any plans to loose this restriction? It would be very useful to use e.g. local all ident admin local sameuser ident sameuser local all password passwd.user and have backup pseudo-users in admin ident-map, allow connecting users to personal databases and list exceptions in password file. Or, is there another way to achieve this? Also, of course, it would be _very_ useful to tell full connects and read-only connects (not allowed to create tables/indexes/views/etc...) Sincerely, D.Marck [DM5020, DM268-RIPE, DM3-RIPN] ------------------------------------------------------------------------ *** Dmitry Morozovsky --- D.Marck --- Wild Woozle --- marck@rinet.ru *** ------------------------------------------------------------------------
Dmitry Morozovsky <marck@rinet.ru> writes: > There is no "fall-through" or "backup": if one record is chosen > and the authentication fails, the following records are not > considered. > Are there any plans to loose this restriction? No. I don't believe we could count on clients to respond to multiple authentication challenges of different types. > It would be very useful to use e.g. > local all ident admin > local sameuser ident sameuser > local all password passwd.user The "sameuser" part of this works now, since sameuser is a record matching constraint, not an authentication test. There has been some talk of adding a more flexible username-matching field to pg_hba (whereupon the file name would be inappropriate ;-)) but no one's really done any work on it. regards, tom lane
> The "sameuser" part of this works now, since sameuser is a record > matching constraint, not an authentication test. > > There has been some talk of adding a more flexible username-matching > field to pg_hba (whereupon the file name would be inappropriate ;-)) > but no one's really done any work on it. I hope to add the username for 7.3. -- Bruce Momjian | http://candle.pha.pa.us pgman@candle.pha.pa.us | (610) 853-3000 + If your life is a hard drive, | 830 Blythe Avenue + Christ can be your backup. | Drexel Hill, Pennsylvania 19026