Chapter 19. Client Authentication
Table of Contents
- 19.1. The
pg_hba.confFile- 19.2. User Name Maps
- 19.3. Authentication Methods
- 19.4. Trust Authentication
- 19.5. Password Authentication
- 19.6. GSSAPI Authentication
- 19.7. SSPI Authentication
- 19.8. Ident Authentication
- 19.9. Peer Authentication
- 19.10. LDAP Authentication
- 19.11. RADIUS Authentication
- 19.12. Certificate Authentication
- 19.13. PAM Authentication
- 19.14. BSD Authentication
- 19.15. Authentication Problems
- 19.2. User Name Maps
When a client application connects to the database server, it specifies whichPostgres Pro database user name it wants to connect as, much the same way one logs into a Unix computer as a particular user. Within the SQL environment the active database user name determines access privileges to database objects — seeChapter 20 for more information. Therefore, it is essential to restrict which database users can connect.
Note
As explained inChapter 20,Postgres Pro actually does privilege management in terms of“roles”. In this chapter, we consistently usedatabase user to mean“role with theLOGIN privilege”.
Authentication is the process by which the database server establishes the identity of the client, and by extension determines whether the client application (or the user who runs the client application) is permitted to connect with the database user name that was requested.
Postgres Pro offers a number of different client authentication methods. The method used to authenticate a particular client connection can be selected on the basis of (client) host address, database, and user.
Postgres Pro database user names are logically separate from user names of the operating system in which the server runs. If all the users of a particular server also have accounts on the server's machine, it makes sense to assign database user names that match their operating system user names. However, a server that accepts remote connections might have many database users who have no local operating system account, and in such cases there need be no connection between database user names and OS user names.