Issue a proper error message when MD5 is attempted when

db_user_namespace is enabled.

Also document this limitation.

diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml
index ca33b8861c3ca2701251dd1b6c44b5d2b3ab1cef..3cfd77faf0cce4ecda973153a8554d25166e5c8e 100644 (file)
--- a/doc/src/sgml/client-auth.sgml
+++ b/doc/src/sgml/client-auth.sgml
@@ -712,6 +712,8 @@ omicron       bryanh            guest1
     If you are at all concerned about password
     <quote>sniffing</> attacks then <literal>md5</> is preferred.
     Plain <literal>password</> should always be avoided if possible.
+    <literal>md5</> cannot be used with <xref
+    linkend="guc-db-user-namespace">.
    </para>
 
    <para>

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 98d01065f727f845f11f17cb9320365c29986c0e..b0de16ec2c3aee360a2848ff813dc98a04a1e177 100644 (file)
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -706,6 +706,17 @@ SET ENABLE_SEQSCAN TO OFF;
         before the user name is looked up by the server.
        </para>
 
+       <para>
+        <varname>db_user_namespace</> causes the client's and
+        server's user name representation to differ.
+        Authentication checks are always done with the server's user name
+        so authentication methods must be configured for the
+        server's user name, not the client's.  Because
+        <literal>md5</> uses the user name as salt on both the
+        client and server, <literal>md5</> cannot be used with
+        <varname>db_user_namespace</>.
+       </para>
+
        <note>
         <para>
          This feature is intended as a temporary measure until a

diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index 104cddb4f9301e240e22cb4c7f084ab64e896ed0..4fb728d963dcfe72f78e8bbc191909ada9565fc0 100644 (file)
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -413,6 +413,10 @@ ClientAuthentication(Port *port)
                        break;
 
                case uaMD5:
+                       if (Db_user_namespace)
+                               ereport(FATAL,
+                                               (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),
+                                                errmsg("MD5 authentication is not supported when \"db_user_namespace\" is enabled")));
                        sendAuthRequest(port, AUTH_REQ_MD5);
                        status = recv_and_check_password_packet(port);
                        break;

diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index 2b8ca9b1f4455e5a676278a7177c695c9076e3d3..78e36cd45469aca5058aab848fbe9e10588adb27 100644 (file)
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -846,7 +846,16 @@ parse_hba_line(List *line, int line_num, HbaLine *parsedline)
        else if (strcmp(token, "reject") == 0)
                parsedline->auth_method = uaReject;
        else if (strcmp(token, "md5") == 0)
+       {
+               if (Db_user_namespace)
+               {
+                       ereport(LOG,
+                                       (errcode(ERRCODE_CONFIG_FILE_ERROR),
+                                        errmsg("MD5 authentication is not supported when \"db_user_namespace\" is enabled")));
+                       return false;
+               }
                parsedline->auth_method = uaMD5;
+       }
        else if (strcmp(token, "pam") == 0)
 #ifdef USE_PAM
                parsedline->auth_method = uaPAM;