diff options
| author | Michael Paquier | 2023-08-26 11:11:19 +0000 |
|---|---|---|
| committer | Michael Paquier | 2023-08-26 11:11:19 +0000 |
| commit | e48b19c5db3185e1868391176fc040df08a149fb (patch) | |
| tree | 629aab9d864bcf063743806f57df4fe0784ede9b /src/backend/libpq/auth.c | |
| parent | 1a4fd77db85abac63e178506335aee74625f6499 (diff) | |
Generate new LOG for "trust" connections under log_connections
Adding an extra LOG for connections that have not set an authn ID, like
when the "trust" authentication method is used, is useful for audit
purposes.
A couple of TAP tests for SSL and authentication need to be tweaked to
adapt to this new LOG generated, as some scenarios expected no logs but
they now get a hit.
Reported-by: Shaun Thomas
Author: Jacob Champion
Reviewed-by: Robert Haas, Michael Paquier
Discussion: https://postgr.es/m/CAFdbL1N7-GF-ZXKaB3XuGA+CkSmnjFvqb8hgjMnDfd+uhL2u-A@mail.gmail.com
Diffstat (limited to 'src/backend/libpq/auth.c')
| -rw-r--r-- | src/backend/libpq/auth.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index 0356fe3e454..81dabb9c273 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -645,6 +645,22 @@ ClientAuthentication(Port *port) #endif } + if (Log_connections && status == STATUS_OK && + !MyClientConnectionInfo.authn_id) + { + /* + * Normally, if log_connections is set, the call to set_authn_id() + * will log the connection. However, if that function is never + * called, perhaps because the trust method is in use, then we handle + * the logging here instead. + */ + ereport(LOG, + errmsg("connection authenticated: user=\"%s\" method=%s " + "(%s:%d)", + port->user_name, hba_authname(port->hba->auth_method), + port->hba->sourcefile, port->hba->linenumber)); + } + if (ClientAuthentication_hook) (*ClientAuthentication_hook) (port, status); |