Re: Proposal: Supporting URI SAN in Certificate Authentication

Hi

Here is the first version of the patch to support URI SAN in certificate
authentication (clientname=URI in pg_hba.conf). We can start a discussion
on the actual code now.The patch can also be reviewed on my “postgres”
project fork [1].

Together with Leonardo Cecchi, CloudNativePG (CNPG) maintainer, we also
tested the patch using the cnpg-i-spiffe plugin[2] that he wrote for the
occasion and the generated container image for CloudNativePG [3]. Everything
worked smoothly, and workloads can now authenticate natively with SPIFFE
IDs.

Given that both CloudNativePG and SPIFFE/SPIRE are CNCF projects, we
contacted
Agustín Martínez Fayó, a SPIRE maintainer, to verify the integration between
the two projects and to begin collaborating on the topic. We decided to
strictly allow only a single URI SAN per certificate. This follows the
X509-SVID spec, avoiding weird edge cases with user mapping, and making
connection logging very clear.

Cheers,
Florin

[1] - https://github.com/irionr/postgres/pull/7

[2] - https://github.com/leonardoce/cnpg-i-spiffe

[3] -
https://github.com/leonardoce/postgres-trunk-containers/actions/runs/35070429177