Bill Studenmund <wrstuden@netbsd.org> writes:
> I think the point is this test and the code after it makes sure that your
> kerberos and your postgres usernames match. I think that's VERY important.
> Otherwise I could log into kerberos as wrstuden and access postgres as
> user tgl. That seems BAD to me. :-)
Well, it's not clear to me. Where did the ticket come from? Perhaps
we've already determined that you are who you say you are just by being
able to acquire the ticket. Even more to the point are the comments in
front of the pg_an_to_ln subroutine: sure, we may be comparing against
*something* extracted from the ticket, but it's not at all clear that
it's a username. Seems like there's lots of potential for BADness in
that.
regards, tom lane