Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am setting up a postgres server that will accept connections that have been authenticated using the SSPI method. These accounts will then be mapped to a single postgres role using the pg_ident.conf file. Is there a way to differentiate between users based on group or OU in the mapping file?

share|improve this question
up vote 1 down vote accepted

That's not possible as-is; postgres ignores all group information from the SSPI token. However, it should be possible to modify auth.c to retrieve TokenPrimaryGroup instead of TokenUser. Then you could use the identity mapping from AD group names to roles (or explicitly map all relevant AD groups to their respective roles).

share|improve this answer
Thank you very much! I think I'll ask on their dev list if that is a decent feature for them to add as well. – chotchki Jan 10 '11 at 14:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.