Re: SYSTEM_USER reserved word implementation

Michael Paquier <michael@paquier.xyz>

From: Michael Paquier <michael@paquier.xyz>
To: "Drouvot, Bertrand" <bdrouvot@amazon.com>
Cc: Jacob Champion <jchampion@timescale.com>, Alvaro Herrera <alvherre@alvh.no-ip.org>, Tom Lane <tgl@sss.pgh.pa.us>, Joe Conway <mail@joeconway.com>, PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Date: 2022-08-24T04:27:12Z
Lists: pgsql-hackers
On Wed, Aug 17, 2022 at 04:48:42PM +0200, Drouvot, Bertrand wrote:
> That way one could test the SYSTEM_USER behavior without the need to have
> kerberos enabled.

I was looking at this patch and noticed that SYSTEM_USER returns a
"name", meaning that the value would be automatically truncated at 63
characters.  We shouldn't imply that as authn_ids can be longer than
that, and this issue gets a bit worse once with the auth_method
appended to the string.

+if (!$use_unix_sockets)
+{
+   plan skip_all =>
+     "authentication tests cannot run without Unix-domain sockets";
+}

Are you sure that !$use_unix_sockets is safe here?  Could we have
platforms where we use our port's getpeereid() with $use_unix_sockets
works?  That would cause the test to fail with ENOSYS.  Hmm.  Without
being able to rely on HAVE_GETPEEREID, we could check for the error
generated when the fallback implementation does not work, and skip the
rest of the test.
--
Michael

Commits

  1. Introduce SYSTEM_USER

  2. Add some information about authenticated identity via log_connections