Skip to content

Commit a2c8499

Browse files
michaelpqmichaelpq
committed
Add system view pg_ident_file_mappings
This view is similar to pg_hba_file_rules view, except that it is associated with the parsing of pg_ident.conf. Similarly to its cousin, this view is useful to check via SQL if changes planned in pg_ident.conf would work upon reload or restart, or to diagnose a previous failure. Bumps catalog version. Author: Julien Rouhaud Reviewed-by: Aleksander Alekseev, Michael Paquier Discussion: https://postgr.es/m/20220223045959.35ipdsvbxcstrhya@jrouhaud
1 parent 091a971 commit a2c8499

File tree

12 files changed

+305
-17
lines changed

12 files changed

+305
-17
lines changed

‎doc/src/sgml/catalogs.sgml

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9591,6 +9591,11 @@ SCRAM-SHA-256$<replaceable>&lt;iteration count&gt;</replaceable>:<replaceable>&l
95919591
<entry>summary of client authentication configuration file contents</entry>
95929592
</row>
95939593

9594+
<row>
9595+
<entry><link linkend="view-pg-ident-file-mappings"><structname>pg_ident_file_mappings</structname></link></entry>
9596+
<entry>summary of client user name mapping configuration file contents</entry>
9597+
</row>
9598+
95949599
<row>
95959600
<entry><link linkend="view-pg-indexes"><structname>pg_indexes</structname></link></entry>
95969601
<entry>indexes</entry>
@@ -10589,6 +10594,108 @@ SCRAM-SHA-256$<replaceable>&lt;iteration count&gt;</replaceable>:<replaceable>&l
1058910594
</para>
1059010595
</sect1>
1059110596

10597+
<sect1 id="view-pg-ident-file-mappings">
10598+
<title><structname>pg_ident_file_mappings</structname></title>
10599+
10600+
<indexterm zone="view-pg-ident-file-mappings">
10601+
<primary>pg_ident_file_mappings</primary>
10602+
</indexterm>
10603+
10604+
<para>
10605+
The view <structname>pg_ident_file_mappings</structname> provides a summary
10606+
of the contents of the client user name mapping configuration file,
10607+
<link linkend="auth-username-maps"><filename>pg_ident.conf</filename></link>.
10608+
A row appears in this view for each non-empty, non-comment line in the file,
10609+
with annotations indicating whether the rule could be applied successfully.
10610+
</para>
10611+
10612+
<para>
10613+
This view can be helpful for checking whether planned changes in the
10614+
authentication configuration file will work, or for diagnosing a previous
10615+
failure. Note that this view reports on the <emphasis>current</emphasis>
10616+
contents of the file, not on what was last loaded by the server.
10617+
</para>
10618+
10619+
<para>
10620+
By default, the <structname>pg_ident_file_mappings</structname> view can be
10621+
read only by superusers.
10622+
</para>
10623+
10624+
<table>
10625+
<title><structname>pg_ident_file_mappings</structname> Columns</title> <tgroup
10626+
cols="1">
10627+
<thead>
10628+
<row>
10629+
<entry role="catalog_table_entry"><para role="column_definition">
10630+
Column Type
10631+
</para>
10632+
<para>
10633+
Description
10634+
</para></entry>
10635+
</row>
10636+
</thead>
10637+
10638+
<tbody>
10639+
<row>
10640+
<entry role="catalog_table_entry"><para role="column_definition">
10641+
<structfield>line_number</structfield> <type>int4</type>
10642+
</para>
10643+
<para>
10644+
Line number of this rule in <filename>pg_ident.conf</filename>
10645+
</para></entry>
10646+
</row>
10647+
10648+
<row>
10649+
<entry role="catalog_table_entry"><para role="column_definition">
10650+
<structfield>map_name</structfield> <type>text</type>
10651+
</para>
10652+
<para>
10653+
Name of the map
10654+
</para></entry>
10655+
</row>
10656+
10657+
<row>
10658+
<entry role="catalog_table_entry"><para role="column_definition">
10659+
<structfield>sys_name</structfield> <type>text</type>
10660+
</para>
10661+
<para>
10662+
Detected user name of the client
10663+
</para></entry>
10664+
</row>
10665+
10666+
<row>
10667+
<entry role="catalog_table_entry"><para role="column_definition">
10668+
<structfield>pg_username</structfield> <type>text</type>
10669+
</para>
10670+
<para>
10671+
Requested PostgreSQL user name
10672+
</para></entry>
10673+
</row>
10674+
10675+
<row>
10676+
<entry role="catalog_table_entry"><para role="column_definition">
10677+
<structfield>error</structfield> <type>text</type>
10678+
</para>
10679+
<para>
10680+
If not <literal>NULL</literal>, an error message indicating why this
10681+
line could not be processed
10682+
</para></entry>
10683+
</row>
10684+
</tbody>
10685+
</tgroup>
10686+
</table>
10687+
10688+
<para>
10689+
Usually, a row reflecting an incorrect entry will have values for only
10690+
the <structfield>line_number</structfield> and <structfield>error</structfield> fields.
10691+
</para>
10692+
10693+
<para>
10694+
See <xref linkend="client-authentication"/> for more information about
10695+
client authentication configuration.
10696+
</para>
10697+
</sect1>
10698+
1059210699
<sect1 id="view-pg-indexes">
1059310700
<title><structname>pg_indexes</structname></title>
1059410701

‎doc/src/sgml/client-auth.sgml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -896,6 +896,16 @@ mymap /^(.*)@otherdomain\.com$ guest
896896
-HUP</literal>) to make it re-read the file.
897897
</para>
898898

899+
<para>
900+
The system view
901+
<link linkend="view-pg-ident-file-mappings"><structname>pg_ident_file_mappings</structname></link>
902+
can be helpful for pre-testing changes to the
903+
<filename>pg_ident.conf</filename> file, or for diagnosing problems if
904+
loading of the file did not have the desired effects. Rows in the view with
905+
non-null <structfield>error</structfield> fields indicate problems in the
906+
corresponding lines of the file.
907+
</para>
908+
899909
<para>
900910
A <filename>pg_ident.conf</filename> file that could be used in
901911
conjunction with the <filename>pg_hba.conf</filename> file in <xref

‎doc/src/sgml/func.sgml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25475,8 +25475,9 @@ SELECT collation for ('foo' COLLATE "de_DE");
2547525475
sending a <systemitem>SIGHUP</systemitem> signal to the postmaster
2547625476
process, which in turn sends <systemitem>SIGHUP</systemitem> to each
2547725477
of its children.) You can use the
25478-
<link linkend="view-pg-file-settings"><structname>pg_file_settings</structname></link> and
25479-
<link linkend="view-pg-hba-file-rules"><structname>pg_hba_file_rules</structname></link> views
25478+
<link linkend="view-pg-file-settings"><structname>pg_file_settings</structname></link>,
25479+
<link linkend="view-pg-hba-file-rules"><structname>pg_hba_file_rules</structname></link> and
25480+
<link linkend="view-pg-hba-file-rules"><structname>pg_ident_file_mappings</structname></link> views
2548025481
to check the configuration files for possible errors, before reloading.
2548125482
</para></entry>
2548225483
</row>

‎src/backend/catalog/system_views.sql

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -617,6 +617,12 @@ CREATE VIEW pg_hba_file_rules AS
617617
REVOKE ALL ON pg_hba_file_rules FROM PUBLIC;
618618
REVOKE EXECUTE ON FUNCTION pg_hba_file_rules() FROM PUBLIC;
619619

620+
CREATE VIEW pg_ident_file_mappings AS
621+
SELECT * FROM pg_ident_file_mappings() AS A;
622+
623+
REVOKE ALL ON pg_ident_file_mappings FROM PUBLIC;
624+
REVOKE EXECUTE ON FUNCTION pg_ident_file_mappings() FROM PUBLIC;
625+
620626
CREATE VIEW pg_timezone_abbrevs AS
621627
SELECT * FROM pg_timezone_abbrevs();
622628

‎src/backend/libpq/hba.c

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -887,37 +887,35 @@ do { \
887887
} while (0)
888888

889889
/*
890-
* Macros for handling pg_ident problems.
891-
* Much as above, but currently the message level is hardwired as LOG
892-
* and there is no provision for an err_msg string.
890+
* Macros for handling pg_ident problems, similar as above.
893891
*
894892
* IDENT_FIELD_ABSENT:
895-
* Log a message and exit the function if the given ident field ListCell is
896-
* not populated.
893+
* Reports when the given ident field ListCell is not populated.
897894
*
898895
* IDENT_MULTI_VALUE:
899-
* Log a message and exit the function if the given ident token List has more
900-
* than one element.
896+
* Reports when the given ident token List has more than one element.
901897
*/
902898
#define IDENT_FIELD_ABSENT(field) \
903899
do { \
904900
if (!field) { \
905-
ereport(LOG, \
901+
ereport(elevel, \
906902
(errcode(ERRCODE_CONFIG_FILE_ERROR), \
907903
errmsg("missing entry in file \"%s\" at end of line %d", \
908904
IdentFileName, line_num))); \
905+
*err_msg = psprintf("missing entry at end of line"); \
909906
return NULL; \
910907
} \
911908
} while (0)
912909

913910
#define IDENT_MULTI_VALUE(tokens) \
914911
do { \
915912
if (tokens->length > 1) { \
916-
ereport(LOG, \
913+
ereport(elevel, \
917914
(errcode(ERRCODE_CONFIG_FILE_ERROR), \
918915
errmsg("multiple values in ident field"), \
919916
errcontext("line %d of configuration file \"%s\"", \
920917
line_num, IdentFileName))); \
918+
*err_msg = psprintf("multiple values in ident field"); \
921919
return NULL; \
922920
} \
923921
} while (0)
@@ -2306,7 +2304,8 @@ load_hba(void)
23062304
* Parse one tokenised line from the ident config file and store the result in
23072305
* an IdentLine structure.
23082306
*
2309-
* If parsing fails, log a message and return NULL.
2307+
* If parsing fails, log a message at ereport level elevel, store an error
2308+
* string in tok_line->err_msg and return NULL.
23102309
*
23112310
* If ident_user is a regular expression (ie. begins with a slash), it is
23122311
* compiled and stored in IdentLine structure.
@@ -2315,10 +2314,11 @@ load_hba(void)
23152314
* to have set a memory context that will be reset if this function returns
23162315
* NULL.
23172316
*/
2318-
static IdentLine *
2319-
parse_ident_line(TokenizedAuthLine *tok_line)
2317+
IdentLine *
2318+
parse_ident_line(TokenizedAuthLine *tok_line, int elevel)
23202319
{
23212320
int line_num = tok_line->line_num;
2321+
char **err_msg = &tok_line->err_msg;
23222322
ListCell *field;
23232323
List *tokens;
23242324
AuthToken *token;
@@ -2372,11 +2372,14 @@ parse_ident_line(TokenizedAuthLine *tok_line)
23722372
char errstr[100];
23732373

23742374
pg_regerror(r, &parsedline->re, errstr, sizeof(errstr));
2375-
ereport(LOG,
2375+
ereport(elevel,
23762376
(errcode(ERRCODE_INVALID_REGULAR_EXPRESSION),
23772377
errmsg("invalid regular expression \"%s\": %s",
23782378
parsedline->ident_user + 1, errstr)));
23792379

2380+
*err_msg = psprintf("invalid regular expression \"%s\": %s",
2381+
parsedline->ident_user + 1, errstr);
2382+
23802383
pfree(wstr);
23812384
return NULL;
23822385
}
@@ -2627,7 +2630,7 @@ load_ident(void)
26272630
continue;
26282631
}
26292632

2630-
if ((newline = parse_ident_line(tok_line)) == NULL)
2633+
if ((newline = parse_ident_line(tok_line, LOG)) == NULL)
26312634
{
26322635
/* Parse error; remember there's trouble */
26332636
ok = false;

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy