{"id":12331,"date":"2019-03-28T19:39:53","date_gmt":"2019-03-28T18:39:53","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/"},"modified":"2019-03-28T19:39:53","modified_gmt":"2019-03-28T18:39:53","slug":"using-operating-system-users-to-connect-to-postgresql","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/","title":{"rendered":"Using operating system users to connect to PostgreSQL"},"content":{"rendered":"<p>PostgreSQL supports many <a href=\"https:\/\/www.postgresql.org\/docs\/current\/auth-pg-hba-conf.html\" target=\"_blank\" rel=\"noopener noreferrer\">authentication methods<\/a> by default and one of them is <a href=\"https:\/\/www.postgresql.org\/docs\/11\/auth-ident.html\" target=\"_blank\" rel=\"noopener noreferrer\">Ident authentication<\/a>. Using that method you can use the users defined in the operating system and map them to users in PostgreSQL. So how does that work?<\/p>\n<p><!--more--><\/p>\n<p>To start, lets create a new operating system user we want to use for connecting to the database:<\/p>\n<pre class=\"brush: bash; gutter: true; first-line: 1\">\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] sudo groupadd user1\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] sudo useradd -g user1 -m user1\n<\/pre>\n<p>The next step is to create a so called <a href=\"https:\/\/www.postgresql.org\/docs\/current\/auth-username-maps.html\" target=\"_blank\" rel=\"noopener noreferrer\">user name map<\/a>. A user map contains the name of the map, the operating system user and the user in PostgreSQL:<\/p>\n<pre class=\"brush: bash; gutter: true; first-line: 1\">\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] echo \"my-map       user1         user1\" &gt;&gt; $PGDATA\/pg_ident.conf\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] tail -5 $PGDATA\/pg_ident.conf\n# Put your actual configuration here\n# ----------------------------------\n\n# MAPNAME       SYSTEM-USERNAME         PG-USERNAME\nmy-map       user1         user1\n<\/pre>\n<p>In our case the name of the PostgreSQL user and the name of the operating system user is the same. You might well map the operating system to another user in PostgreSQL, e.g. user2.<\/p>\n<p>Obviously our user needs to exist in PostgreSQL, so:<\/p>\n<pre class=\"brush: bash; gutter: true; first-line: 1\">\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] psql -c \"create user user1 with login\" postgres\nCREATE ROLE\n<\/pre>\n<p>Finally we need to add an entry to <a href=\"https:\/\/www.postgresql.org\/docs\/current\/auth-pg-hba-conf.html\" target=\"_blank\" rel=\"noopener noreferrer\">pg_hba.conf<\/a> that matches our map and authentication method:<\/p>\n<pre class=\"brush: bash; gutter: true; first-line: 1\">\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] echo \"host    all    all    192.168.22.0\/24    ident map=my-map\" &gt;&gt; $PGDATA\/pg_hba.conf\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] pg_ctl -D $PGDATA reload\nserver signaled\n<\/pre>\n<p>Lets try to connect to the database with our new user:<\/p>\n<pre class=\"brush: bash; gutter: true; first-line: 1\">\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] sudo su - user1\n[user1@pgbox ~]$ \/u01\/app\/postgres\/product\/DEV\/db_1\/bin\/psql -h 192.168.22.99 -p 5433 -U user1 postgres\npsql: FATAL:  Ident authentication failed for user \"user1\"\n<\/pre>\n<p>&#8230; and that fails. When we check the PostgreSQL log file this is reported:<\/p>\n<pre class=\"brush: bash; gutter: true; first-line: 1\">\n2019-03-19 18:33:26.724 CET - 1 - 8174 - 192.168.22.99 - user1@postgres LOG:  could not connect to Ident server at address \"192.168.22.99\", port 113: Connection refused\n2019-03-19 18:33:26.724 CET - 2 - 8174 - 192.168.22.99 - user1@postgres FATAL:  Ident authentication failed for user \"user1\"\n2019-03-19 18:33:26.724 CET - 3 - 8174 - 192.168.22.99 - user1@postgres DETAIL:  Connection matched pg_hba.conf line 94: \"host    all    all    192.168.22.0\/24    ident map=my-map\"\n<\/pre>\n<p>Our entry in pg_hba.conf matches, at least that is fine. But PostgreSQL is not able to connect to the Ident server and this confirms that nothing is listening on that port:<\/p>\n<pre class=\"brush: bash; gutter: true; first-line: 1\">\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] sudo netstat -tulpen | grep 113\n<\/pre>\n<p>I am running CentOS 7 so the procedure for installing and starting an ident server is this:<\/p>\n<pre class=\"brush: bash; gutter: true; first-line: 1\">\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] sudo yum search oident\nLoaded plugins: fastestmirror\nLoading mirror speeds from cached hostfile\n * base: pkg.adfinis-sygroup.ch\n * epel: pkg.adfinis-sygroup.ch\n * extras: mirror1.hs-esslingen.de\n * updates: mirror.softaculous.com\n=============================================================================================== N\/S matched: oident ===============================================================================================\noidentd.x86_64 : Implementation of the RFC1413 identification server\n\n  Name and summary matches only, use \"search all\" for everything.\n\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] sudo yum install oidentd\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] systemctl list-unit-files | grep -i ident\noidentd.service                               disabled\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] sudo systemctl enable oidentd.service\nCreated symlink from \/etc\/systemd\/system\/multi-user.target.wants\/oidentd.service to \/usr\/lib\/systemd\/system\/oidentd.service.\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] sudo systemctl start oidentd.service\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] sudo netstat -tulpen | grep 113\ntcp        0      0 0.0.0.0:113             0.0.0.0:*               LISTEN      0          48553      8978\/oidentd        \n<\/pre>\n<p>Lets try again:<\/p>\n<pre class=\"brush: bash; gutter: true; first-line: 1\">\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] sudo su - user1\nLast login: Tue Mar 19 18:33:25 CET 2019 on pts\/1\n[user1@pgbox ~]$ \/u01\/app\/postgres\/product\/DEV\/db_1\/bin\/psql -h 192.168.22.99 -p 5433 -U user1 postgres\npsql (12devel)\nType \"help\" for help.\n\npostgres=&gt; \n<\/pre>\n<p>&#8230; and now it works. We can connect using the operating system without specifying a password. To complete this post lets create another operating system user and map it to a different account in PostgreSQL:<\/p>\n<pre class=\"brush: bash; gutter: true; first-line: 1\">\npostgres@pgbox:\/home\/postgres\/ [PGDEV] sudo groupadd user2\npostgres@pgbox:\/home\/postgres\/ [PGDEV] sudo useradd -g user2 -m user2\npostgres@pgbox:\/home\/postgres\/ [PGDEV] echo \"my-map       user2         user1\" &gt;&gt; $PGDATA\/pg_ident.conf\npostgres@pgbox:\/home\/postgres\/ [PGDEV] tail $PGDATA\/pg_ident.conf\n# a SIGHUP signal.  If you edit the file on a running system, you have\n# to SIGHUP the postmaster for the changes to take effect.  You can\n# use \"pg_ctl reload\" to do that.\n\n# Put your actual configuration here\n# ----------------------------------\n\n# MAPNAME       SYSTEM-USERNAME         PG-USERNAME\nmy-map       user1         user1\nmy-map       user2         user1\npostgres@pgbox:\/home\/postgres\/ [PGDEV] pg_ctl -D $PGDATA reload\nserver signaled\n<\/pre>\n<p>user2 should now be able to connect to user1 in PostgreSQL as well:<\/p>\n<pre class=\"brush: bash; gutter: true; first-line: 1\">\npostgres@pgbox:\/u02\/pgdata\/DEV\/ [PGDEV] sudo su - user2\nLast login: Tue Mar 19 18:55:06 CET 2019 on pts\/1\n[user2@pgbox ~]$ \/u01\/app\/postgres\/product\/DEV\/db_1\/bin\/psql -h 192.168.22.99 -p 5433 -U user1 postgres\npsql (12devel)\nType \"help\" for help.\n\npostgres=&gt; \n<\/pre>\n<p>Finally, be careful with this authentication method. The <a href=\"https:\/\/www.postgresql.org\/docs\/current\/auth-ident.html\" target=\"_blank\" rel=\"noopener noreferrer\">documentation<\/a> is very clear about that: &#8220;The drawback of this procedure is that it depends on the integrity of the client: if the client machine is untrusted or compromised, an attacker could run just about any program on port 113 and return any user name they choose. This authentication method is therefore only appropriate for closed networks where each client machine is under tight control and where the database and system administrators operate in close contact. In other words, you must trust the machine running the ident server. Heed the warning: The Identification Protocol is not intended as an authorization or access control protocol.&#8221;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>PostgreSQL supports many authentication methods by default and one of them is Ident authentication. Using that method you can use the users defined in the operating system and map them to users in PostgreSQL. So how does that work?<\/p>\n","protected":false},"author":28,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[229],"tags":[77],"type_dbi":[],"class_list":["post-12331","post","type-post","status-publish","format-standard","hentry","category-database-administration-monitoring","tag-postgresql"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.8 (Yoast SEO v28.8) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Using operating system users to connect to PostgreSQL - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Using operating system users to connect to PostgreSQL\" \/>\n<meta property=\"og:description\" content=\"PostgreSQL supports many authentication methods by default and one of them is Ident authentication. Using that method you can use the users defined in the operating system and map them to users in PostgreSQL. So how does that work?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2019-03-28T18:39:53+00:00\" \/>\n<meta name=\"author\" content=\"Open source Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Open source Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/using-operating-system-users-to-connect-to-postgresql\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/using-operating-system-users-to-connect-to-postgresql\\\/\"},\"author\":{\"name\":\"Open source Team\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4bae5e5dd8c7d48edbd948772b49b202\"},\"headline\":\"Using operating system users to connect to PostgreSQL\",\"datePublished\":\"2019-03-28T18:39:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/using-operating-system-users-to-connect-to-postgresql\\\/\"},\"wordCount\":391,\"commentCount\":0,\"keywords\":[\"PostgreSQL\"],\"articleSection\":[\"Database Administration &amp; Monitoring\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/using-operating-system-users-to-connect-to-postgresql\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/using-operating-system-users-to-connect-to-postgresql\\\/\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/using-operating-system-users-to-connect-to-postgresql\\\/\",\"name\":\"Using operating system users to connect to PostgreSQL - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\"},\"datePublished\":\"2019-03-28T18:39:53+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4bae5e5dd8c7d48edbd948772b49b202\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/using-operating-system-users-to-connect-to-postgresql\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/using-operating-system-users-to-connect-to-postgresql\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/using-operating-system-users-to-connect-to-postgresql\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Using operating system users to connect to PostgreSQL\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4bae5e5dd8c7d48edbd948772b49b202\",\"name\":\"Open source Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g\",\"caption\":\"Open source Team\"},\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/author\\\/open-source-team\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Using operating system users to connect to PostgreSQL - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/","og_locale":"en_US","og_type":"article","og_title":"Using operating system users to connect to PostgreSQL","og_description":"PostgreSQL supports many authentication methods by default and one of them is Ident authentication. Using that method you can use the users defined in the operating system and map them to users in PostgreSQL. So how does that work?","og_url":"https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/","og_site_name":"dbi Blog","article_published_time":"2019-03-28T18:39:53+00:00","author":"Open source Team","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Open source Team","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/"},"author":{"name":"Open source Team","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4bae5e5dd8c7d48edbd948772b49b202"},"headline":"Using operating system users to connect to PostgreSQL","datePublished":"2019-03-28T18:39:53+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/"},"wordCount":391,"commentCount":0,"keywords":["PostgreSQL"],"articleSection":["Database Administration &amp; Monitoring"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/","url":"https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/","name":"Using operating system users to connect to PostgreSQL - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"datePublished":"2019-03-28T18:39:53+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4bae5e5dd8c7d48edbd948772b49b202"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/using-operating-system-users-to-connect-to-postgresql\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Using operating system users to connect to PostgreSQL"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4bae5e5dd8c7d48edbd948772b49b202","name":"Open source Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g","caption":"Open source Team"},"url":"https:\/\/www.dbi-services.com\/blog\/author\/open-source-team\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/12331","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=12331"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/12331\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=12331"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=12331"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=12331"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=12331"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}