On Fedora 12, I'm setting up a test database for myself, and pg_hba.conf contains the following by default:


# "local" is for Unix domain socket connections only
local   all         all                               ident
# IPv4 local connections:
host    all         all          ident
# IPv6 local connections:
host    all         all         ::1/128               ident

I want to enable md5 logins so the PostgreSQL user named 'foo' can access the database named 'foo'. However, when I add this line and restart postgres:

local   foo         foo                               md5

Running psql -U 'foo' with my regular user account still yields the message:

psql: FATAL:  Ident authentication failed for user "foo"

I have to remove the first local line (which has ident) before I can log in via md5 to 'foo'.

How can I enable md5 authentication for 'foo' while keeping ident authentication like I already have?

1 Answer 1


https://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html indicates that the order of entries maters, specifically:

Since the pg_hba.conf records are examined sequentially for each connection attempt, the order of the records is significant. Typically, earlier records will have tight connection match parameters and weaker authentication methods, while later records will have looser match parameters and stronger authentication methods. For example, one might wish to use trust authentication for local TCP/IP connections but require a password for remote TCP/IP connections. In this case a record specifying trust authentication for connections from would appear before a record specifying password authentication for a wider range of allowed client IP addresses.

(so try reversing the order - put the line you are adding at the top)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.