Re: [PoC] Delegating pg_ident to a third party

On Mon, 2022-01-10 at 15:09 -0500, Stephen Frost wrote: > Greetings, Sorry for the delay, the last few weeks have been insane. > * Jacob Champion (pchamp...@vmware.com) wrote: > > On Tue, 2022-01-04 at 22:24 -0500, Stephen Frost wrote: > > > On Tue, Jan 4, 2022 at 18:56 Jacob Champion wrote: > >

Re: [PoC] Delegating pg_ident to a third party

Greetings, * Jacob Champion (pchamp...@vmware.com) wrote: > On Tue, 2022-01-04 at 22:24 -0500, Stephen Frost wrote: > > On Tue, Jan 4, 2022 at 18:56 Jacob Champion wrote: > > > > > > Could you talk more about the use cases for which having the "actual > > > user" is better? From an auditing pers

Re: [PoC] Delegating pg_ident to a third party

On Tue, 2022-01-04 at 22:24 -0500, Stephen Frost wrote: > On Tue, Jan 4, 2022 at 18:56 Jacob Champion wrote: > > > > Could you talk more about the use cases for which having the "actual > > user" is better? From an auditing perspective I don't see why > > "authenticated as ja...@example.net, logg

Re: [PoC] Delegating pg_ident to a third party

Greetings, On Tue, Jan 4, 2022 at 18:56 Jacob Champion wrote: > On Mon, 2022-01-03 at 19:42 -0500, Stephen Frost wrote: > > * Jacob Champion (pchamp...@vmware.com) wrote: > > > > > > That last point was my motivation for the authn_id patch [1] -- so that > > > auditing could see the actual user

Re: [PoC] Delegating pg_ident to a third party

On Mon, 2022-01-03 at 19:42 -0500, Stephen Frost wrote: > * Jacob Champion (pchamp...@vmware.com) wrote: > > > > That last point was my motivation for the authn_id patch [1] -- so that > > auditing could see the actual user _and_ the generic role. The > > information is already there to be used, i

Re: [PoC] Delegating pg_ident to a third party

Greetings, * Jacob Champion (pchamp...@vmware.com) wrote: > On Mon, 2022-01-03 at 12:36 -0500, Stephen Frost wrote: > > * Jacob Champion (pchamp...@vmware.com) wrote: > > > On Fri, 2021-12-17 at 10:06 +0100, Peter Eisentraut wrote: > > > > On 17.12.21 00:48, Jacob Champion wrote: > > > > > WDYT? (

Re: [PoC] Delegating pg_ident to a third party

On Mon, 2022-01-03 at 12:36 -0500, Stephen Frost wrote: > * Jacob Champion (pchamp...@vmware.com) wrote: > > On Fri, 2021-12-17 at 10:06 +0100, Peter Eisentraut wrote: > > > On 17.12.21 00:48, Jacob Champion wrote: > > > > WDYT? (My responses here will be slower than usual. Hope you all have a > >

Re: [PoC] Delegating pg_ident to a third party

Greetings, * Jacob Champion (pchamp...@vmware.com) wrote: > On Fri, 2021-12-17 at 10:06 +0100, Peter Eisentraut wrote: > > On 17.12.21 00:48, Jacob Champion wrote: > > > WDYT? (My responses here will be slower than usual. Hope you all have a > > > great end to the year!) > > > > Looks interesting

Re: [PoC] Delegating pg_ident to a third party

On Fri, 2021-12-17 at 10:06 +0100, Peter Eisentraut wrote: > On 17.12.21 00:48, Jacob Champion wrote: > > WDYT? (My responses here will be slower than usual. Hope you all have a > > great end to the year!) > > Looks interesting. I wonder whether putting this into pg_ident.conf is > sensible. I

Re: [PoC] Delegating pg_ident to a third party

On 17.12.21 00:48, Jacob Champion wrote: WDYT? (My responses here will be slower than usual. Hope you all have a great end to the year!) Looks interesting. I wonder whether putting this into pg_ident.conf is sensible. I suspect people will want to eventually add more features around this,

[PoC] Delegating pg_ident to a third party

Hi all, In keeping with my theme of expanding the authentication/authorization options for the server, attached is an experimental patchset that lets Postgres determine an authenticated user's allowed roles by querying an LDAP server, and enables SASL binding for those queries. This lets you dele