Skip site navigation (1) Skip section navigation (2)

Re: Connect error

From: Bill Moseley <moseley(at)hank(dot)org>
To: Russell Shaw <rjshaw(at)iprimus(dot)com(dot)au>
Cc: pgsql-novice(at)postgresql(dot)org
Subject: Re: Connect error
Date: 2004-01-13 06:03:20
Message-ID: 20040113060317.GB551@hank.org (view raw, whole thread or download thread mbox)
Thread:
Lists: pgsql-novice
On Tue, Jan 13, 2004 at 02:38:04PM +1100, Russell Shaw wrote:
> 
> In pg_ident.conf, i put:
> 
>   # MAPNAME   IDENT-USERNAME  PG-USERNAME
>   apache      www-data        russell
>   apache      russell         russell
> 
> This works:
>   psql -U russell parts_list
> 
> This doesn't:
>   psql -U www-data parts_list
> 
> It says: psql: FATAL:  IDENT authentication failed for user "www-data"

I don't think that's how it works.  But, I'm just learning -- so I'll 
try and get it correct (but no guarantees).

The idea is you can do this:

   $ su www-data     # now you are the web server user
   $ psql -U russell parts_lists

So you are saying with -U that you want to connect at the *Postgres*
user "russell".  Now, normally, postgres would do an ident[1] and say,
"Ok, you want to connect as user "russell" but the ident returned you
as user "www-data" so you are not authenticated."

But, by using the map:

   apache www-data russell

that says (or so I'm guessing) that "ok, when ident returns 'www-data' 
map that to user 'russell' and use that username for connecting 
to the database."  And thus you are requesting to connect as user (-U) 
russell and now the ident has been mapped to user russell so you are 
authenticated.

Or to say it another way, when you are user "russell" and you connect
to psql it can do an ident and say authenticate that you really are 
"russell".  But when you are another unix user, but you use -U to 
specify the username, it can't authenticate you -- so the map allows 
mapping of one unix username to another for authentication purposes.

All that, of course, has to work with pg_hba.conf.

BTW - I found it somewhat confusing because the default (at least mine) 
pg_hba.conf says any user that is also a postgres user can authenticate 
and then access any database when they connect from their own account.

  local   all         all  ident sameuser

> I've tried adding -h localhost also.
> 
> How can i test the identd server for user www-data?
> www-data is in /etc/passwd, and i can also su to it.

Yes, but www-data is not a Postgres user -- and doesn't need to be.

[1] Also, when using psql you don't need an ident server running to 
authenticate -- just like "whoami" will report your username without 
using an ident server.  That said, I hope someone will explain that 
better with regard to how unix-domain sockets work.

I trust someone will correct any errors in the above...


-- 
Bill Moseley
moseley(at)hank(dot)org


In response to

Responses

pgsql-novice by date

Next:From: Russell ShawDate: 2004-01-13 09:17:02
Subject: Re: Connect error
Previous:From: Oliver ElphickDate: 2004-01-13 05:32:00
Subject: Re: Cluster in users home

Privacy Policy | About PostgreSQL
Copyright © 1996-2017 The PostgreSQL Global Development Group