Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit745513c

Browse files
committed
Clarify usage of clientcert authentication option.
For some reason this option wasn't discussed at all in client-auth.sgml.Document it there, and be more explicit about its relationship to the"cert" authentication method. Per gripe from Srikanth Venkatesh.I failed to resist the temptation to do some minor wordsmithing in thesame area, too.Discussion: <20160713110357.1410.30407@wrigleys.postgresql.org>
1 parent99dd8b0 commit745513c

File tree

2 files changed

+39
-15
lines changed

2 files changed

+39
-15
lines changed

‎doc/src/sgml/client-auth.sgml

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -547,6 +547,15 @@ hostnossl <replaceable>database</replaceable> <replaceable>user</replaceable>
547547
specify options for the authentication method. Details about which
548548
options are available for which authentication methods appear below.
549549
</para>
550+
551+
<para>
552+
In addition to the method-specific options listed below, there is one
553+
method-independent authentication option <literal>clientcert</>, which
554+
can be specified in any <literal>hostssl</> record. When set
555+
to <literal>1</>, this option requires the client to present a valid
556+
(trusted) SSL certificate, in addition to the other requirements of the
557+
authentication method.
558+
</para>
550559
</listitem>
551560
</varlistentry>
552561
</variablelist>
@@ -1632,9 +1641,9 @@ host ... ldap ldapurl="ldap://ldap.example.net/dc=example,dc=net?uid?sub"
16321641
This authentication method uses SSL client certificates to perform
16331642
authentication. It is therefore only available for SSL connections.
16341643
When using this authentication method, the server will require that
1635-
the client provide a validcertificate. No password prompt will be sent
1636-
to the client. The <literal>cn</literal> (Common Name) attribute of the
1637-
certificate
1644+
the client provide a valid, trustedcertificate.No password prompt
1645+
will be sentto the client.The <literal>cn</literal> (Common Name)
1646+
attribute of thecertificate
16381647
will be compared to the requested database user name, and if they match
16391648
the login will be allowed. User name mapping can be used to allow
16401649
<literal>cn</literal> to be different from the database user name.
@@ -1655,6 +1664,16 @@ host ... ldap ldapurl="ldap://ldap.example.net/dc=example,dc=net?uid?sub"
16551664
</varlistentry>
16561665
</variablelist>
16571666
</para>
1667+
1668+
<para>
1669+
In a <filename>pg_hba.conf</> record specifying certificate
1670+
authentication, the authentication option <literal>clientcert</> is
1671+
assumed to be <literal>1</>, and it cannot be turned off since a client
1672+
certificate is necessary for this method. What the <literal>cert</>
1673+
method adds to the basic <literal>clientcert</> certificate validity test
1674+
is a check that the <literal>cn</literal> attribute matches the database
1675+
user name.
1676+
</para>
16581677
</sect2>
16591678

16601679
<sect2 id="auth-pam">

‎doc/src/sgml/runtime.sgml

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2189,20 +2189,23 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
21892189
<sect2 id="ssl-client-certificates">
21902190
<title>Using Client Certificates</title>
21912191

2192-
<para>
2192+
<para>
21932193
To require the client to supply a trusted certificate, place
21942194
certificates of the certificate authorities (<acronym>CA</acronym>s)
21952195
you trust in the file <filename>root.crt</filename> in the data
21962196
directory, set the parameter <xref linkend="guc-ssl-ca-file"> in
21972197
<filename>postgresql.conf</filename> to <literal>root.crt</literal>,
2198-
and set the <literal>clientcert</literal> parameter
2199-
to 1 on the appropriate <literal>hostssl</> line(s) in
2200-
<filename>pg_hba.conf</>.
2198+
and add the authentication option <literal>clientcert=1</literal> to the
2199+
appropriate <literal>hostssl</> line(s) in <filename>pg_hba.conf</>.
22012200
A certificate will then be requested from the client during
22022201
SSL connection startup. (See <xref linkend="libpq-ssl"> for a
22032202
description of how to set up certificates on the client.) The server will
22042203
verify that the client's certificate is signed by one of the trusted
2205-
certificate authorities. If intermediate <acronym>CA</>s appear in
2204+
certificate authorities.
2205+
</para>
2206+
2207+
<para>
2208+
If intermediate <acronym>CA</>s appear in
22062209
<filename>root.crt</filename>, the file must also contain certificate
22072210
chains to their root <acronym>CA</>s. Certificate Revocation List
22082211
(CRL) entries
@@ -2214,12 +2217,12 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
22142217
</para>
22152218

22162219
<para>
2217-
The <literal>clientcert</literal> optionin <filename>pg_hba.conf</> is
2218-
available forall authentication methods, but onlyfor rows specified as
2219-
<literal>hostssl</>. When <literal>clientcert</literal> is not specified
2220-
or is set to 0, the server will still verifypresented client
2221-
certificates against its CAlist, if one is configured,
2222-
&mdash; butit will not insist that a client certificate be presented.
2220+
The <literal>clientcert</literal>authenticationoptionis available for
2221+
all authentication methods, but onlyin <filename>pg_hba.conf</> lines
2222+
specified as<literal>hostssl</>. When <literal>clientcert</literal> is
2223+
not specifiedor is set to 0, the server will still verifyany presented
2224+
clientcertificates against its CAfile, if one is configured &mdash; but
2225+
it will not insist that a client certificate be presented.
22232226
</para>
22242227

22252228
<para>
@@ -2234,7 +2237,9 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
22342237
If you are setting up client certificates, you may wish to use
22352238
the <literal>cert</> authentication method, so that the certificates
22362239
control user authentication as well as providing connection security.
2237-
See <xref linkend="auth-cert"> for details.
2240+
See <xref linkend="auth-cert"> for details. (It is not necessary to
2241+
specify <literal>clientcert=1</literal> explicitly when using
2242+
the <literal>cert</> authentication method.)
22382243
</para>
22392244
</sect2>
22402245

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp