Re: [PoC] Delegating pg_ident to a third party

2022-02-02 Thread Jacob Champion
On Mon, 2022-01-10 at 15:09 -0500, Stephen Frost wrote: > Greetings, Sorry for the delay, the last few weeks have been insane. > * Jacob Champion (pchamp...@vmware.com) wrote: > > On Tue, 2022-01-04 at 22:24 -0500, Stephen Frost wrote: > > > On Tue, Jan 4, 2022 at 18:56 Jacob Champion wrote: > >

Re: [PoC] Delegating pg_ident to a third party

2022-01-10 Thread Stephen Frost
Greetings, * Jacob Champion (pchamp...@vmware.com) wrote: > On Tue, 2022-01-04 at 22:24 -0500, Stephen Frost wrote: > > On Tue, Jan 4, 2022 at 18:56 Jacob Champion wrote: > > > > > > Could you talk more about the use cases for which having the "actual > > > user" is better? From an auditing pers

Re: [PoC] Delegating pg_ident to a third party

2022-01-07 Thread Jacob Champion
On Tue, 2022-01-04 at 22:24 -0500, Stephen Frost wrote: > On Tue, Jan 4, 2022 at 18:56 Jacob Champion wrote: > > > > Could you talk more about the use cases for which having the "actual > > user" is better? From an auditing perspective I don't see why > > "authenticated as ja...@example.net, logg

Re: [PoC] Delegating pg_ident to a third party

2022-01-04 Thread Stephen Frost
Greetings, On Tue, Jan 4, 2022 at 18:56 Jacob Champion wrote: > On Mon, 2022-01-03 at 19:42 -0500, Stephen Frost wrote: > > * Jacob Champion (pchamp...@vmware.com) wrote: > > > > > > That last point was my motivation for the authn_id patch [1] -- so that > > > auditing could see the actual user

Re: [PoC] Delegating pg_ident to a third party

2022-01-04 Thread Jacob Champion
On Mon, 2022-01-03 at 19:42 -0500, Stephen Frost wrote: > * Jacob Champion (pchamp...@vmware.com) wrote: > > > > That last point was my motivation for the authn_id patch [1] -- so that > > auditing could see the actual user _and_ the generic role. The > > information is already there to be used, i

Re: [PoC] Delegating pg_ident to a third party

2022-01-03 Thread Stephen Frost
Greetings, * Jacob Champion (pchamp...@vmware.com) wrote: > On Mon, 2022-01-03 at 12:36 -0500, Stephen Frost wrote: > > * Jacob Champion (pchamp...@vmware.com) wrote: > > > On Fri, 2021-12-17 at 10:06 +0100, Peter Eisentraut wrote: > > > > On 17.12.21 00:48, Jacob Champion wrote: > > > > > WDYT? (

Re: [PoC] Delegating pg_ident to a third party

2022-01-03 Thread Jacob Champion
On Mon, 2022-01-03 at 12:36 -0500, Stephen Frost wrote: > * Jacob Champion (pchamp...@vmware.com) wrote: > > On Fri, 2021-12-17 at 10:06 +0100, Peter Eisentraut wrote: > > > On 17.12.21 00:48, Jacob Champion wrote: > > > > WDYT? (My responses here will be slower than usual. Hope you all have a > >

Re: [PoC] Delegating pg_ident to a third party

2022-01-03 Thread Stephen Frost
Greetings, * Jacob Champion (pchamp...@vmware.com) wrote: > On Fri, 2021-12-17 at 10:06 +0100, Peter Eisentraut wrote: > > On 17.12.21 00:48, Jacob Champion wrote: > > > WDYT? (My responses here will be slower than usual. Hope you all have a > > > great end to the year!) > > > > Looks interesting

Re: [PoC] Delegating pg_ident to a third party

2022-01-03 Thread Jacob Champion
On Fri, 2021-12-17 at 10:06 +0100, Peter Eisentraut wrote: > On 17.12.21 00:48, Jacob Champion wrote: > > WDYT? (My responses here will be slower than usual. Hope you all have a > > great end to the year!) > > Looks interesting. I wonder whether putting this into pg_ident.conf is > sensible. I

Re: [PoC] Delegating pg_ident to a third party

2021-12-17 Thread Peter Eisentraut
On 17.12.21 00:48, Jacob Champion wrote: WDYT? (My responses here will be slower than usual. Hope you all have a great end to the year!) Looks interesting. I wonder whether putting this into pg_ident.conf is sensible. I suspect people will want to eventually add more features around this,