Re: "cert" + clientcert=verify-ca in pg_hba.conf?
От | Kyotaro Horiguchi |
---|---|
Тема | Re: "cert" + clientcert=verify-ca in pg_hba.conf? |
Дата | |
Msg-id | 20200827.160925.279969179228617520.horikyota.ntt@gmail.com обсуждение исходный текст |
Ответ на | Re: "cert" + clientcert=verify-ca in pg_hba.conf? (Bruce Momjian <bruce@momjian.us>) |
Ответы |
Re: "cert" + clientcert=verify-ca in pg_hba.conf?
(Bruce Momjian <bruce@momjian.us>)
|
Список | pgsql-hackers |
At Wed, 26 Aug 2020 18:36:50 -0400, Bruce Momjian <bruce@momjian.us> wrote in bruce> On Wed, Aug 26, 2020 at 06:13:23PM +0900, Kyotaro Horiguchi wrote: > > At Tue, 25 Aug 2020 22:52:44 -0400, Bruce Momjian <bruce@momjian.us> wrote in > > > > Because we think we need any named value for every alternatives > > > > including the default value? > > > > > > Well, not putting clientcert at all gives the default behavior, so why > > > have clientcert=no-verify? > > > > clientcert=verify-ca or verify-full don't allow absence of client > > certificate. We need an option to allow the absence. > > Isn't the option not specifying clientcert? Here are some valid > pg_hba.conf lines: Sorry for the ambiguity. Perhaps I understand that we talked at different objects. I was mentioning about the option value that is stored *internally*, concretely the values for the struct member port->hba->clientcert. You are talking about the descriptive option in pg_hba.conf. Does the following discussion make sense? We need to use the default value zero (=clientCertOff) for port->hba->clientcert to tell server to omit checking against CA if cert is not given. I suppose that the value clientCertOff is labeled as "no-verify" since someone who developed this thought that that choice needs to be explicitly describable in pg_hba.conf. And my discussion was following that decision. I understand that the label "no-verify" is not essential to specify the behavior, so I don't object to removing "no-verify" label itself if no one oppose to remove it. My point here is just "are we OK to remove it?" > It is my understanding that the last two lines are the same. Why isn't > it sufficient to just tell users not to specify clientcert if they want > the default behavior? You can do: > > host all all 192.168.0.0/16 ident map=omicron > > but there is no way to specify the default map value of 'no map', so why > have one for clientcert? The difference from clientcert is that it gives an arbitrary name that points to a defined mapping, not a choice from an defined enumeration. > > > Well, sslmode=prefer gives encryption without identification. > > > clientcert=no-verify has no value because it is just an optional CA > > > check that has no value because optional authentication is useless. It > > > > The point of the option is not to do optional CA check if possible, > > but to allow absence of client cert. We need to have that mode > > regardless of named or not named, and I believe we usually provide a > > name for default mode. > > Uh, see above --- not really. The absense of the option is the default > action. regards. -- Kyotaro Horiguchi NTT Open Source Software Center
В списке pgsql-hackers по дате отправления:
Предыдущее
От: Asim PraveenДата:
Сообщение: Re: SyncRepLock acquired exclusively in default configuration
Следующее
От: Michael PaquierДата:
Сообщение: Re: Typo in procarray.c comment about GlobalVisDataRels