Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I presently use "md5" authentication for access from the lan:

host all all 192.168.1.0/24 md5

I want to add ldap authentication method, so I added this line before:

host all all 192.168.1.0/24 ldap "ldap://192.168.1.2/basedn;uid=;,cn=xx,dc=yy,dc=zz,dc=ca"

This work great with ldap accounts, but if I try to login with an account not present on the LDAP server, the login fails (postgresql doesn't try the md5 authentication).

There is a way to support more than one authentication method with postgresql?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

No -- Since the pg_hba.conf records are examined sequentially for each connection attempt, the order of the records is significant. -- In other words "First match is the method I'm going to use".
You would have to explicitly list all the local (md5) accounts before proceeding to the "all users" LDAP authentication in order for this to work (and that starts to get hairy with maintaining the pg_hba.conf file).

As a workaround you can use the pam authentication method, and configure PAM's "postgres" service to use whatever methods you wish (including falling back to alternate methods), but this limits you to whatever PAM modules are installed/configured on your system.
(For suitably broad definitions of "limits" -- e.g. you could use one-time passwords for Postgres accounts if you use PAM as the authentication method).

share|improve this answer
    
Thank you for the answer. I defined this rule: host all @pgUsers 192.168.1.0/24 md5 and created a pgUsers file to define user to authenticate against pg authentication instead of ldap. Seem to work great. –  Francis Mar 19 '12 at 12:37
    
Also a good solution -- the only downside I see is that it doesn't buy you the (potential for) single sign-on like LDAP would. –  voretaq7 Mar 19 '12 at 15:29
    
I still use LDAP for authenticating my users. I use postgresql auth only for users account used by web applications because I don't want to create them LDAP accounts. –  Francis Mar 19 '12 at 18:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.