Re: Can we stop defaulting to 'ident'?

Поиск
Список
Период
Сортировка
От Craig Ringer
Тема Re: Can we stop defaulting to 'ident'?
Дата
Msg-id CAMsr+YHAipW2tH-334ZLcROqx4Q55mB7JZY8CyV0AZMi_yfB2g@mail.gmail.com
обсуждение исходный текст
Ответ на Re: Can we stop defaulting to 'ident'?  (Stephen Frost <sfrost@snowman.net>)
Список pgsql-pkg-yum
On Fri, 20 Dec 2019 at 01:32, Stephen Frost <sfrost@snowman.net> wrote:
Greetings,

* James Cassell (fedoraproject@cyberpear.com) wrote:
> Peer does not work with TCP connections, and I haven't figured how to get,e.g., third-party Java applications working without TCP.

The entire point of peer was to segregate the very insecure 'ident' from
the actually quite secure 'peer' auth, so, no, it's not going to work
over TCP connections- that's more-or-less the point.

Regarding a JDBC connection, you can pass in a "socketFactory", as I
understand it (though I'm no JDBC expert, I'd suggest you address issues
you have with that to the JDBC list):

https://jdbc.postgresql.org/documentation/head/connect.html

Right. PgJDBC doesn't actually have to support it directly, since you can pass your own socketFactory, such as one provided by https://github.com/kohlschutter/junixsocket or https://github.com/jnr/jnr-unixsocket .

As the Java Language specification does not provide for UNIX socket support and no widely used JVM bundles AF_UNIX socket support there's no way for PgJDBC to directly support unix sockets. We could add support for it in jdbc:postgresql:// URLs, but we'd have to do a runtime search of the classpath to find a suitable SocketFactory using a list of known unix socket library implementations ... so why bother? If the user has to install a 3rd party library to do it anyway, they can specify a JDBC URL argument too.

So PgJDBC already has everything it needs there IMO, except perhaps a hint in the documentation. Patches welcome :)

--
 Craig Ringer                   http://www.2ndQuadrant.com/
 2ndQuadrant - PostgreSQL Solutions for the Enterprise

В списке pgsql-pkg-yum по дате отправления:

Предыдущее
От: Craig Ringer
Дата:
Сообщение: Re: Can we stop defaulting to 'ident'?
Следующее
От: Devrim Gündüz
Дата:
Сообщение: Re: Can we stop defaulting to 'ident'?