PostgreSQL 8.4beta2 Documentation | ||||
---|---|---|---|---|
Prev | Fast Backward | Chapter 19. Client Authentication | Fast Forward | Next |
When using an external authentication system like Ident or GSSAPI, the name of the operating system user that initiated the connection may not be the same as the database user he is requesting to connect as. In this case, a user name map can be applied to map the operating system username to a database user, using the pg_ident.conf file. In order to use username mapping, specify map=map-name in the options field in pg_hba.conf. This option is supported for all authentication methods that receive external usernames. Since the pg_ident.conf file can contain multiple maps, the name of the map to be used is specified in the map-name parameter in pg_hba.conf to indicate which map to use for each individual connection.
Ident maps are defined in the ident map file, which by default is named pg_ident.conf and is stored in the cluster's data directory. (It is possible to place the map file elsewhere, however; see the ident_file configuration parameter.) The ident map file contains lines of the general form:
map-name system-username database-username
Comments and whitespace are handled in the same way as in pg_hba.conf. The map-name is an arbitrary name that will be used to refer to this mapping in pg_hba.conf. The other two fields specify which operating system user is allowed to connect as which database user. The same map-name can be used repeatedly to specify more user-mappings within a single map. There is no restriction regarding how many database users a given operating system user can correspond to, nor vice versa.
If the system-username field starts with a slash (/), the contents of the field is treated as a regular expression. This regular expression supports a single capture, which can be back-referenced as \1 (backslash-one). This allows the mapping of different syntax names with a single line.
mymap /(.*)@mydomain.com \1 mymap /(.*)@otherdomain.com guest
will "remove" the domain part for users with system usernames @mydomain.com, and allow all users from @otherdomain.com to log in as guest.
The pg_ident.conf file is read on start-up and when the main server process receives a SIGHUP signal. If you edit the file on an active system, you will need to signal the server (using pg_ctl reload or kill -HUP) to make it re-read the file.
A pg_ident.conf file that could be used in conjunction with the pg_hba.conf file in Example 19-1 is shown in Example 19-2. In this example setup, anyone logged in to a machine on the 192.168 network that does not have the Unix user name bryanh, ann, or robert would not be granted access. Unix user robert would only be allowed access when he tries to connect as PostgreSQL user bob, not as robert or anyone else. ann would only be allowed to connect as ann. User bryanh would be allowed to connect as either bryanh himself or as guest1.