On 2019-07-22 19:40, Andres Freund wrote: > On 2019-07-22 13:02:13 -0400, Andrew Dunstan wrote: >> There are a few things we could do. We could force trust auth, or we >> could add an ident map that allowed $USER to login as buildfarm. Finding >> all the places we would need to fix that could be a fun project ... > > Perhaps we could actually do so automatically when the initdb invoking > user isn't the same as the OS user? Imo that'd be generally quite > useful, and not just for the regression tets.
It seems to me that there is something missing in our client authentication system here. If I'm logged in as the OS user that owns the data directory, I should be able to log in to the database system via local socket as any user. Because why stop me? I can just change pg_hba.conf to let me in. That would also address this problem that when you use the initdb -U option, the proposed default "peer" setting doesn't help you much. Making a pg_ident.conf map automatically helps for that particular user combination, but then not for other users. (There is no "sameuser plus these additional mappings".) I think we could just define that if geteuid == getpeereid, then authentication succeeds. Possibly make that a setting if someone wants to turn it off. -- Peter Eisentraut http://www.2ndQuadrant.com/ PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
