Re: phpPgAdmin + PostgreSQL + authentication

I've used phpPgAdmin before. My guess is that your failing because
postgresql is expecting an md5'd password to authenticate with, and
phpPgAdmin is passing in an unencrypted password. 

On a related note, setting phpPgAdmin to advanced authentication mode,
it will rely on the information in pg_shadow.

Robert Treat

On Tue, 2002-10-08 at 12:21, Johnson, Shaunn wrote:
> Howdy: 
> 
> Not sure if this the most likely of maillists to ask, 
> but is anyone using phpPgAdmin?  I have a few questions 
> regarding authentication of username / passwords. 
> 
> I'm running PostgreSQL 7.2.1 on RedHat Linux 7.2 kernel 2.4.7-10. 
> I have phpPgAdmin 2.4.2 installed. 
> 
> Basically, I want to know:  how to configure phpPgAdmin to 
> allow all the users that exist in pg_shadow to log in and 
> be authenticated? 
> 
> In my pg_hba.conf, I have this: 
> 
> [snip conf file] 
> 
> # TYPE     DATABASE    IP_ADDRESS    MASK               AUTH_TYPE
> AUTH_ARGUMENT 
> local        all                                            trust 
> host         all         127.0.0.1       255.255.255.255    md5 
> host         all         16.x.x.1        255.0.0.0          md5 
> host         all         192.168.0.0     255.255.255.0      md5 
> 
> [/snip conf file] 
> 
> In the config.inc.php, I have this: 
> 
> [snip php conf] 
> 
> 
> // The $cfgServers array starts with $cfgServers[1].  Do not use
> $cfgServers[0]. 
> // You can disable a server config entry by setting host to ''. 
> $cfgServers[1]['local']         = false; 
> $cfgServers[1]['host']          = 'test.localserver.net'; 
> $cfgServers[1]['port']          = '5432'; 
> $cfgServers[1]['adv_auth']      = true; 
> 
> $cfgServers[1]['user']          = '';   // if you are not using
> adv_auth, 
>                                                     // enter the
> username to connect all the time 
> $cfgServers[1]['password']      = '';   // if you are not using adv_auth
> and 
>                                                     // a password is
> required enter a password 
> $cfgServers[1]['only_db']       = '';   // if set to a db-name, only
> this db is accessible 
> 
> 
> [/snip php conf] 
> 
> As I understand it, shouldn't this allow any user with TCP connection 
> to access the database?  I suppose I am trying to understand if 
> adv_auth even uses pg_shadow at all, or, does 'local' means that 
> no authentication is needed, anyone can log in. 
> 
> The only thing that  happens at the index.php page is when I log 
> in, I get "Wrong username/password. Access denied". 
> 
> I mean, if I can access the database via command line (psql -U joe -d
> testdb) 
> without needing to authenticate myself, shouldn't that mean that
> phpPgAdmin 
> allows the same thing?  Otherwise, I should be able to use what's in 
> pg_shadow, right? 
> 
> I am re-reading the documentation page.  Any info / direction is
> appreciated. 
> 
> Thanks! 
> 
> -X 
>