I am setting up a postgres server that will accept connections that have been authenticated using the SSPI method. These accounts will then be mapped to a single postgres role using the pg_ident.conf file. Is there a way to differentiate between users based on group or OU in the mapping file?
1 Answer
That's not possible as-is; postgres ignores all group information from the SSPI token. However, it should be possible to modify auth.c to retrieve TokenPrimaryGroup instead of TokenUser. Then you could use the identity mapping from AD group names to roles (or explicitly map all relevant AD groups to their respective roles).
-
Thank you very much! I think I'll ask on their dev list if that is a decent feature for them to add as well.– chotchkiJan 10, 2011 at 14:01