Enable both ident and md5 authentication in PostgreSQL

Question

On Fedora 12, I'm setting up a test database for myself, and pg_hba.conf contains the following by default:

# TYPE  DATABASE    USER        CIDR-ADDRESS          METHOD

# "local" is for Unix domain socket connections only
local   all         all                               ident
# IPv4 local connections:
host    all         all         127.0.0.1/32          ident
# IPv6 local connections:
host    all         all         ::1/128               ident

I want to enable md5 logins so the PostgreSQL user named 'foo' can access the database named 'foo'. However, when I add this line and restart postgres:

local   foo         foo                               md5

Running psql -U 'foo' with my regular user account still yields the message:

psql: FATAL:  Ident authentication failed for user "foo"

I have to remove the first local line (which has ident) before I can log in via md5 to 'foo'.

How can I enable md5 authentication for 'foo' while keeping ident authentication like I already have?

Answer 1

https://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html indicates that the order of entries maters, specifically:

Since the pg_hba.conf records are examined sequentially for each connection attempt, the order of the records is significant. Typically, earlier records will have tight connection match parameters and weaker authentication methods, while later records will have looser match parameters and stronger authentication methods. For example, one might wish to use trust authentication for local TCP/IP connections but require a password for remote TCP/IP connections. In this case a record specifying trust authentication for connections from 127.0.0.1 would appear before a record specifying password authentication for a wider range of allowed client IP addresses.

(so try reversing the order - put the line you are adding at the top)