Add annotation syntax to pg_hba.conf entries

From: Jim Jones <jim(dot)jones(at)uni-muenster(dot)de>
To: PostgreSQL Hackers <pgsql-hackers(at)lists(dot)postgresql(dot)org>
Cc: Daniel Gustafsson <daniel(at)yesql(dot)se>, Peter Eisentraut <peter(at)eisentraut(dot)org>
Subject: Add annotation syntax to pg_hba.conf entries
Date: 2023-10-04 20:03:38
Message-ID: 997377b9-b2c7-452d-75af-eca6668d6e77@uni-muenster.de
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi,

I'm opening this thread after a brief discussion regarding a potential
new syntax to enable annotations in pg_hba entries. [1]

This feature mainly aims to annotate pg_hba entries in a way that the
annotations can be parsed and displayed in the pg_hba_file_rule view for
reporting purposes. For instance, these annotations could contain
information like tags, client (application) names or any relevant info
regarding the granted access.

Initially I explored the possibility of using the inline comments after
a '#', but there were a few valid concerns to this approach [2]

hostssl  db  jim  127.0.0.1/32  cert  map=foo  # comment

I had previously thought of introducing a new character do identify such
annotations, e.g [] ... but the necessary changes in the hba.c to add
this feature could add too much complexity to the code. [3]

Perhaps a "less controversial" option would be to add a new variable,
just like with user name maps.

hostssl  db  jim  127.0.0.1/32  cert  map=foo  annotation=comment
hostssl  db  jim  127.0.0.1/32  cert  map=bar annotation="comment"

Any thoughts?

Thanks!

Jim

1-
https://www.postgresql.org/message-id/flat/4d623899-36ac-71b5-311d-2a4672d75736(at)uni-muenster(dot)de
2-
https://www.postgresql.org/message-id/E543222B-DE8D-4116-BA67-3C2D3FA83110%40yesql.se
3-
https://www.postgresql.org/message-id/flat/ZPHAiNp%2ByKMsa/vc%40paquier.xyz#05a8405be272342037538ee432d92884

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Robert Haas 2023-10-04 20:08:29 Re: trying again to get incremental backup
Previous Message Nathan Bossart 2023-10-04 19:50:59 Re: --sync-method isn't documented to take an argument