Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Authentication for admin database #573

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

erthalion
Copy link

Hi,

From what I understand, if stats_users specified in configuration, it needs
to be present in auth_file to be able to connect to the admin db. This is the
case even if stats_users could be authenticated via auth_user +
auth_query for all other "regular" databases. Looks like it happens because
the admin db is a special "fake" database without an auth_user. If pgbouncer
would be able to authenticate stats_users connecting to the admin db using
auth_query as well, this will be helpful because one doesn't need to maintain
another set of credentials for a monitoring user.

From the first glance there are just few bits missing to implement this. E.g. a
default_auth_db to connect to for authentication purposes in case of admin
db. Does this implementation make sense?

This idea also partially intersects with #569, but instead of restricting this
patch for admin databases it handles them differently.

As the admin database is a "fake" one, auth_user is not being set for
it. Which in turn means if provided stats_user credentials should be put
into the auth_file, this user connected to the admin db can not be
authenticated via the underlying db itself.

In this case allow pgbouncer to connect to the default_auth_db to
perform authentication. This will allow to avoid managing another set of
credentials.
@erthalion
Copy link
Author

Looks like appveyor tests are failing, because postgres version has changed since the last build (from postgresql-12.4-1 to postgresql-13.1-1). Probably something needs to be adjusted in the postgres config, looking into this, but I guess it's not relevant for this particular patch:

2021-02-21 12:37:45.633 UTC [5280] LOG:  listening on IPv6 address "::1", port 6666
2021-02-21 12:37:45.633 UTC [5280] LOG:  listening on IPv4 address "127.0.0.1", port 6666
2021-02-21 12:37:45.648 UTC [5280] FATAL:  could not create lock file "/tmp/.s.PGSQL.6666.lock": No such file or directory
2021-02-21 12:37:45.648 UTC [5280] LOG:  database system is shut down
 stopped waiting
pg_ctl: could not start server
Examine the log output.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant