diff options
| author | Andrew Dunstan <andrew@dunslane.net> | 2021-03-29 15:31:22 -0400 |
|---|---|---|
| committer | Andrew Dunstan <andrew@dunslane.net> | 2021-03-29 15:49:39 -0400 |
| commit | 6d7a6feac48b1970c4cd127ee65d4c487acbb5e9 (patch) | |
| tree | 8728162431269b3ae654eddb1d3a8e1c99972ec3 /src/test/ssl/t/SSLServer.pm | |
| parent | efcc7572f532ea564fedc6359c2df43045ee7908 (diff) | |
| download | postgresql-6d7a6feac48b1970c4cd127ee65d4c487acbb5e9.tar.gz postgresql-6d7a6feac48b1970c4cd127ee65d4c487acbb5e9.zip | |
Allow matching the DN of a client certificate for authentication
Currently we only recognize the Common Name (CN) of a certificate's
subject to be matched against the user name. Thus certificates with
subjects '/OU=eng/CN=fred' and '/OU=sales/CN=fred' will have the same
connection rights. This patch provides an option to match the whole
Distinguished Name (DN) instead of just the CN. On any hba line using
client certificate identity, there is an option 'clientname' which can
have values of 'DN' or 'CN'. The default is 'CN', the current procedure.
The DN is matched against the RFC2253 formatted DN, which looks like
'CN=fred,OU=eng'.
This facility of probably best used in conjunction with an ident map.
Discussion: https://postgr.es/m/92e70110-9273-d93c-5913-0bccb6562740@dunslane.net
Reviewed-By: Michael Paquier, Daniel Gustafsson, Jacob Champion
Diffstat (limited to 'src/test/ssl/t/SSLServer.pm')
| -rw-r--r-- | src/test/ssl/t/SSLServer.pm | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/src/test/ssl/t/SSLServer.pm b/src/test/ssl/t/SSLServer.pm index 5ec5e0dac88..c494c1ad1cb 100644 --- a/src/test/ssl/t/SSLServer.pm +++ b/src/test/ssl/t/SSLServer.pm @@ -109,6 +109,9 @@ sub configure_test_server_for_ssl $node->psql('postgres', "CREATE USER yetanotheruser"); $node->psql('postgres', "CREATE DATABASE trustdb"); $node->psql('postgres', "CREATE DATABASE certdb"); + $node->psql('postgres', "CREATE DATABASE certdb_dn"); + $node->psql('postgres', "CREATE DATABASE certdb_dn_re"); + $node->psql('postgres', "CREATE DATABASE certdb_cn"); $node->psql('postgres', "CREATE DATABASE verifydb"); # Update password of each user as needed. @@ -217,7 +220,20 @@ sub configure_hba_for_ssl "hostssl verifydb yetanotheruser $servercidr $authmethod clientcert=verify-ca\n"; print $hba "hostssl certdb all $servercidr cert\n"; + print $hba + "hostssl certdb_dn all $servercidr cert clientname=DN map=dn\n", + "hostssl certdb_dn_re all $servercidr cert clientname=DN map=dnre\n", + "hostssl certdb_cn all $servercidr cert clientname=CN map=cn\n"; close $hba; + + # Also set the ident maps. Note: fields with commas must be quoted + open my $map, ">", "$pgdata/pg_ident.conf"; + print $map + "# MAPNAME SYSTEM-USERNAME PG-USERNAME\n", + "dn \"CN=ssltestuser-dn,OU=Testing,OU=Engineering,O=PGDG\" ssltestuser\n", + "dnre \"/^.*OU=Testing,.*\$\" ssltestuser\n", + "cn ssltestuser-dn ssltestuser\n"; + return; } |