Skip to content

Commit a2c8499

Browse files
michaelpqmichaelpq
committed
Add system view pg_ident_file_mappings
This view is similar to pg_hba_file_rules view, except that it is associated with the parsing of pg_ident.conf. Similarly to its cousin, this view is useful to check via SQL if changes planned in pg_ident.conf would work upon reload or restart, or to diagnose a previous failure. Bumps catalog version. Author: Julien Rouhaud Reviewed-by: Aleksander Alekseev, Michael Paquier Discussion: https://postgr.es/m/20220223045959.35ipdsvbxcstrhya@jrouhaud
1 parent 091a971 commit a2c8499

File tree

12 files changed

+305
-17
lines changed

12 files changed

+305
-17
lines changed

‎doc/src/sgml/catalogs.sgml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9591,6 +9591,11 @@ SCRAM-SHA-256$<replaceable>&lt;iteration count&gt;</replaceable>:<replaceable>&l
95919591
<entry>summary of client authentication configuration file contents</entry>
95929592
</row>
95939593

9594+
<row>
9595+
<entry><link linkend="view-pg-ident-file-mappings"><structname>pg_ident_file_mappings</structname></link></entry>
9596+
<entry>summary of client user name mapping configuration file contents</entry>
9597+
</row>
9598+
95949599
<row>
95959600
<entry><link linkend="view-pg-indexes"><structname>pg_indexes</structname></link></entry>
95969601
<entry>indexes</entry>
@@ -10589,6 +10594,108 @@ SCRAM-SHA-256$<replaceable>&lt;iteration count&gt;</replaceable>:<replaceable>&l
1058910594
</para>
1059010595
</sect1>
1059110596

10597+
<sect1 id="view-pg-ident-file-mappings">
10598+
<title><structname>pg_ident_file_mappings</structname></title>
10599+
10600+
<indexterm zone="view-pg-ident-file-mappings">
10601+
<primary>pg_ident_file_mappings</primary>
10602+
</indexterm>
10603+
10604+
<para>
10605+
The view <structname>pg_ident_file_mappings</structname> provides a summary
10606+
of the contents of the client user name mapping configuration file,
10607+
<link linkend="auth-username-maps"><filename>pg_ident.conf</filename></link>.
10608+
A row appears in this view for each non-empty, non-comment line in the file,
10609+
with annotations indicating whether the rule could be applied successfully.
10610+
</para>
10611+
10612+
<para>
10613+
This view can be helpful for checking whether planned changes in the
10614+
authentication configuration file will work, or for diagnosing a previous
10615+
failure. Note that this view reports on the <emphasis>current</emphasis>
10616+
contents of the file, not on what was last loaded by the server.
10617+
</para>
10618+
10619+
<para>
10620+
By default, the <structname>pg_ident_file_mappings</structname> view can be
10621+
read only by superusers.
10622+
</para>
10623+
10624+
<table>
10625+
<title><structname>pg_ident_file_mappings</structname> Columns</title> <tgroup
10626+
cols="1">
10627+
<thead>
10628+
<row>
10629+
<entry role="catalog_table_entry"><para role="column_definition">
10630+
Column Type
10631+
</para>
10632+
<para>
10633+
Description
10634+
</para></entry>
10635+
</row>
10636+
</thead>
10637+
10638+
<tbody>
10639+
<row>
10640+
<entry role="catalog_table_entry"><para role="column_definition">
10641+
<structfield>line_number</structfield> <type>int4</type>
10642+
</para>
10643+
<para>
10644+
Line number of this rule in <filename>pg_ident.conf</filename>
10645+
</para></entry>
10646+
</row>
10647+
10648+
<row>
10649+
<entry role="catalog_table_entry"><para role="column_definition">
10650+
<structfield>map_name</structfield> <type>text</type>
10651+
</para>
10652+
<para>
10653+
Name of the map
10654+
</para></entry>
10655+
</row>
10656+
10657+
<row>
10658+
<entry role="catalog_table_entry"><para role="column_definition">
10659+
<structfield>sys_name</structfield> <type>text</type>
10660+
</para>
10661+
<para>
10662+
Detected user name of the client
10663+
</para></entry>
10664+
</row>
10665+
10666+
<row>
10667+
<entry role="catalog_table_entry"><para role="column_definition">
10668+
<structfield>pg_username</structfield> <type>text</type>
10669+
</para>
10670+
<para>
10671+
Requested PostgreSQL user name
10672+
</para></entry>
10673+
</row>
10674+
10675+
<row>
10676+
<entry role="catalog_table_entry"><para role="column_definition">
10677+
<structfield>error</structfield> <type>text</type>
10678+
</para>
10679+
<para>
10680+
If not <literal>NULL</literal>, an error message indicating why this
10681+
line could not be processed
10682+
</para></entry>
10683+
</row>
10684+
</tbody>
10685+
</tgroup>
10686+
</table>
10687+
10688+
<para>
10689+
Usually, a row reflecting an incorrect entry will have values for only
10690+
the <structfield>line_number</structfield> and <structfield>error</structfield> fields.
10691+
</para>
10692+
10693+
<para>
10694+
See <xref linkend="client-authentication"/> for more information about
10695+
client authentication configuration.
10696+
</para>
10697+
</sect1>
10698+
1059210699
<sect1 id="view-pg-indexes">
1059310700
<title><structname>pg_indexes</structname></title>
1059410701

‎doc/src/sgml/client-auth.sgml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -896,6 +896,16 @@ mymap /^(.*)@otherdomain\.com$ guest
896896
-HUP</literal>) to make it re-read the file.
897897
</para>
898898

899+
<para>
900+
The system view
901+
<link linkend="view-pg-ident-file-mappings"><structname>pg_ident_file_mappings</structname></link>
902+
can be helpful for pre-testing changes to the
903+
<filename>pg_ident.conf</filename> file, or for diagnosing problems if
904+
loading of the file did not have the desired effects. Rows in the view with
905+
non-null <structfield>error</structfield> fields indicate problems in the
906+
corresponding lines of the file.
907+
</para>
908+
899909
<para>
900910
A <filename>pg_ident.conf</filename> file that could be used in
901911
conjunction with the <filename>pg_hba.conf</filename> file in <xref

‎doc/src/sgml/func.sgml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25475,8 +25475,9 @@ SELECT collation for ('foo' COLLATE "de_DE");
2547525475
sending a <systemitem>SIGHUP</systemitem> signal to the postmaster
2547625476
process, which in turn sends <systemitem>SIGHUP</systemitem> to each
2547725477
of its children.) You can use the
25478-
<link linkend="view-pg-file-settings"><structname>pg_file_settings</structname></link> and
25479-
<link linkend="view-pg-hba-file-rules"><structname>pg_hba_file_rules</structname></link> views
25478+
<link linkend="view-pg-file-settings"><structname>pg_file_settings</structname></link>,
25479+
<link linkend="view-pg-hba-file-rules"><structname>pg_hba_file_rules</structname></link> and
25480+
<link linkend="view-pg-hba-file-rules"><structname>pg_ident_file_mappings</structname></link> views
2548025481
to check the configuration files for possible errors, before reloading.
2548125482
</para></entry>
2548225483
</row>

‎src/backend/catalog/system_views.sql‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -617,6 +617,12 @@ CREATE VIEW pg_hba_file_rules AS
617617
REVOKE ALL ON pg_hba_file_rules FROM PUBLIC;
618618
REVOKE EXECUTE ON FUNCTION pg_hba_file_rules() FROM PUBLIC;
619619

620+
CREATE VIEW pg_ident_file_mappings AS
621+
SELECT * FROM pg_ident_file_mappings() AS A;
622+
623+
REVOKE ALL ON pg_ident_file_mappings FROM PUBLIC;
624+
REVOKE EXECUTE ON FUNCTION pg_ident_file_mappings() FROM PUBLIC;
625+
620626
CREATE VIEW pg_timezone_abbrevs AS
621627
SELECT * FROM pg_timezone_abbrevs();
622628

‎src/backend/libpq/hba.c‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -887,37 +887,35 @@ do { \
887887
} while (0)
888888

889889
/*
890-
* Macros for handling pg_ident problems.
891-
* Much as above, but currently the message level is hardwired as LOG
892-
* and there is no provision for an err_msg string.
890+
* Macros for handling pg_ident problems, similar as above.
893891
*
894892
* IDENT_FIELD_ABSENT:
895-
* Log a message and exit the function if the given ident field ListCell is
896-
* not populated.
893+
* Reports when the given ident field ListCell is not populated.
897894
*
898895
* IDENT_MULTI_VALUE:
899-
* Log a message and exit the function if the given ident token List has more
900-
* than one element.
896+
* Reports when the given ident token List has more than one element.
901897
*/
902898
#define IDENT_FIELD_ABSENT(field) \
903899
do { \
904900
if (!field) { \
905-
ereport(LOG, \
901+
ereport(elevel, \
906902
(errcode(ERRCODE_CONFIG_FILE_ERROR), \
907903
errmsg("missing entry in file \"%s\" at end of line %d", \
908904
IdentFileName, line_num))); \
905+
*err_msg = psprintf("missing entry at end of line"); \
909906
return NULL; \
910907
} \
911908
} while (0)
912909

913910
#define IDENT_MULTI_VALUE(tokens) \
914911
do { \
915912
if (tokens->length > 1) { \
916-
ereport(LOG, \
913+
ereport(elevel, \
917914
(errcode(ERRCODE_CONFIG_FILE_ERROR), \
918915
errmsg("multiple values in ident field"), \
919916
errcontext("line %d of configuration file \"%s\"", \
920917
line_num, IdentFileName))); \
918+
*err_msg = psprintf("multiple values in ident field"); \
921919
return NULL; \
922920
} \
923921
} while (0)
@@ -2306,7 +2304,8 @@ load_hba(void)
23062304
* Parse one tokenised line from the ident config file and store the result in
23072305
* an IdentLine structure.
23082306
*
2309-
* If parsing fails, log a message and return NULL.
2307+
* If parsing fails, log a message at ereport level elevel, store an error
2308+
* string in tok_line->err_msg and return NULL.
23102309
*
23112310
* If ident_user is a regular expression (ie. begins with a slash), it is
23122311
* compiled and stored in IdentLine structure.
@@ -2315,10 +2314,11 @@ load_hba(void)
23152314
* to have set a memory context that will be reset if this function returns
23162315
* NULL.
23172316
*/
2318-
static IdentLine *
2319-
parse_ident_line(TokenizedAuthLine *tok_line)
2317+
IdentLine *
2318+
parse_ident_line(TokenizedAuthLine *tok_line, int elevel)
23202319
{
23212320
int line_num = tok_line->line_num;
2321+
char **err_msg = &tok_line->err_msg;
23222322
ListCell *field;
23232323
List *tokens;
23242324
AuthToken *token;
@@ -2372,11 +2372,14 @@ parse_ident_line(TokenizedAuthLine *tok_line)
23722372
char errstr[100];
23732373

23742374
pg_regerror(r, &parsedline->re, errstr, sizeof(errstr));
2375-
ereport(LOG,
2375+
ereport(elevel,
23762376
(errcode(ERRCODE_INVALID_REGULAR_EXPRESSION),
23772377
errmsg("invalid regular expression \"%s\": %s",
23782378
parsedline->ident_user + 1, errstr)));
23792379

2380+
*err_msg = psprintf("invalid regular expression \"%s\": %s",
2381+
parsedline->ident_user + 1, errstr);
2382+
23802383
pfree(wstr);
23812384
return NULL;
23822385
}
@@ -2627,7 +2630,7 @@ load_ident(void)
26272630
continue;
26282631
}
26292632

2630-
if ((newline = parse_ident_line(tok_line)) == NULL)
2633+
if ((newline = parse_ident_line(tok_line, LOG)) == NULL)
26312634
{
26322635
/* Parse error; remember there's trouble */
26332636
ok = false;

0 commit comments

Comments
 (0)