Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitb09f930

Browse files
committed
Add hba parameter include_realm to krb5, gss and sspi authentication, used
to pass the full username@realm string to the authentication instead ofjust the username. This makes it possible to use pg_ident.conf to authenticateusers from multiple realms as different database users.
1 parent32c469d commitb09f930

File tree

4 files changed

+69
-7
lines changed

4 files changed

+69
-7
lines changed

‎doc/src/sgml/client-auth.sgml

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.116 2009/01/0712:38:10 mha Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.117 2009/01/0713:09:21 mha Exp $ -->
22

33
<chapter id="client-authentication">
44
<title>Client Authentication</title>
@@ -785,6 +785,18 @@ omicron bryanh guest1
785785
</listitem>
786786
</varlistentry>
787787

788+
<varlistentry>
789+
<term>include_realm</term>
790+
<listitem>
791+
<para>
792+
Include the realm name from the authenticated user principal. This is useful
793+
in combination with Username maps (See <xref linkend="auth-username-maps">
794+
for details), especially with regular expressions, to map users from
795+
multiple realms.
796+
</para>
797+
</listitem>
798+
</varlistentry>
799+
788800
<varlistentry>
789801
<term>krb_realm</term>
790802
<listitem>
@@ -846,6 +858,18 @@ omicron bryanh guest1
846858
</listitem>
847859
</varlistentry>
848860

861+
<varlistentry>
862+
<term>include_realm</term>
863+
<listitem>
864+
<para>
865+
Include the realm name from the authenticated user principal. This is useful
866+
in combination with Username maps (See <xref linkend="auth-username-maps">
867+
for details), especially with regular expressions, to map users from
868+
multiple realms.
869+
</para>
870+
</listitem>
871+
</varlistentry>
872+
849873
<varlistentry>
850874
<term>krb_realm</term>
851875
<listitem>

‎src/backend/libpq/auth.c

Lines changed: 30 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.176 2009/01/0712:38:11 mha Exp $
11+
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.177 2009/01/0713:09:21 mha Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -748,7 +748,13 @@ pg_krb5_recvauth(Port *port)
748748
cp=strchr(kusername,'@');
749749
if (cp)
750750
{
751-
*cp='\0';
751+
/*
752+
* If we are not going to include the realm in the username that is passed
753+
* to the ident map, destructively modify it here to remove the realm. Then
754+
* advance past the separator to check the realm.
755+
*/
756+
if (!port->hba->include_realm)
757+
*cp='\0';
752758
cp++;
753759

754760
if (realmmatch!=NULL&&strlen(realmmatch))
@@ -1040,7 +1046,13 @@ pg_GSS_recvauth(Port *port)
10401046
{
10411047
char*cp=strchr(gbuf.value,'@');
10421048

1043-
*cp='\0';
1049+
/*
1050+
* If we are not going to include the realm in the username that is passed
1051+
* to the ident map, destructively modify it here to remove the realm. Then
1052+
* advance past the separator to check the realm.
1053+
*/
1054+
if (!port->hba->include_realm)
1055+
*cp='\0';
10441056
cp++;
10451057

10461058
if (realmmatch!=NULL&&strlen(realmmatch))
@@ -1361,8 +1373,22 @@ pg_SSPI_recvauth(Port *port)
13611373
/*
13621374
* We have the username (without domain/realm) in accountname, compare to
13631375
* the supplied value. In SSPI, always compare case insensitive.
1376+
*
1377+
* If set to include realm, append it in <username>@<realm> format.
13641378
*/
1365-
returncheck_usermap(port->hba->usermap,port->user_name,accountname, true);
1379+
if (port->hba->include_realm)
1380+
{
1381+
char*namebuf;
1382+
intretval;
1383+
1384+
namebuf=palloc(strlen(accountname)+strlen(domainname)+2);
1385+
sprintf(namebuf,"%s@%s",accountname,domainname);
1386+
retval=check_usermap(port->hba->usermap,port->user_name,namebuf, true);
1387+
pfree(namebuf);
1388+
returnretval;
1389+
}
1390+
else
1391+
returncheck_usermap(port->hba->usermap,port->user_name,accountname, true);
13661392
}
13671393
#endif/* ENABLE_SSPI */
13681394

‎src/backend/libpq/hba.c

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
*
1111
*
1212
* IDENTIFICATION
13-
* $PostgreSQL: pgsql/src/backend/libpq/hba.c,v 1.179 2009/01/0712:38:11 mha Exp $
13+
* $PostgreSQL: pgsql/src/backend/libpq/hba.c,v 1.180 2009/01/0713:09:21 mha Exp $
1414
*
1515
*-------------------------------------------------------------------------
1616
*/
@@ -1053,6 +1053,17 @@ parse_hba_line(List *line, int line_num, HbaLine *parsedline)
10531053
INVALID_AUTH_OPTION("krb_realm","krb5, gssapi and sspi");
10541054
parsedline->krb_realm=pstrdup(c);
10551055
}
1056+
elseif (strcmp(token,"include_realm")==0)
1057+
{
1058+
if (parsedline->auth_method!=uaKrb5&&
1059+
parsedline->auth_method!=uaGSS&&
1060+
parsedline->auth_method!=uaSSPI)
1061+
INVALID_AUTH_OPTION("include_realm","krb5, gssapi and sspi");
1062+
if (strcmp(c,"1")==0)
1063+
parsedline->include_realm= true;
1064+
else
1065+
parsedline->include_realm= false;
1066+
}
10561067
else
10571068
{
10581069
ereport(LOG,

‎src/include/libpq/hba.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* Interface to hba.c
55
*
66
*
7-
* $PostgreSQL: pgsql/src/include/libpq/hba.h,v 1.54 2009/01/0712:38:11 mha Exp $
7+
* $PostgreSQL: pgsql/src/include/libpq/hba.h,v 1.55 2009/01/0713:09:21 mha Exp $
88
*
99
*-------------------------------------------------------------------------
1010
*/
@@ -58,6 +58,7 @@ typedef struct
5858
boolclientcert;
5959
char*krb_server_hostname;
6060
char*krb_realm;
61+
boolinclude_realm;
6162
}HbaLine;
6263

6364
typedefstructPorthbaPort;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp