Re: Kerberos principal to dbuser mapping

> > > Is there any existing way of making queries from
> > > postmaster (other than setting up a client
> > > connection from it)?
> >
> > There is no existing way, and none will be added in
> > the future either.
> > There are good system-reliability reasons for
> > keeping the postmaster
> > away from the database.
>
> Ok, but it seems wasteful to build primitive database
> functionality in parallell to the real database.

This issue affects mutual SSL authentication and PKIX in
addition to Kerberos. See a followup post for details....
Bottom line: we should identify and document a canonical
solution.

P.S., in the case of PKIX, there's a well-defined interface
and there's no conceptual problem with maintaining the database
via the regular client interface. Bootstrapping the system may
be another matter.

Bear