Re: Connect error

OK, I think I get it now.

For a database "newdb", created by user moseley and to only
allow connections from user moseley and the web server running as www-data
add the following line early:

    # TYPE  DATABASE    USER    IP-ADDRESS  IP-MASK   METHOD
    local    newdb       all                          ident webaccess

So, all unix-domain connections (local) trying to connect to user "newdb"
will check the "webaccess" map in the pg_ident.conf file.

    webaccess    moseley  moseley
    webaccess    www-data moseley

The first one is basically duplicating the "sameuser" feature.
Connection requests as user moseley must ident as user moseley.

The second one says connections for user moseley can ident as
"www-data".  "www-data" does not need to be a postgres user, of course.

    bumby:~$ whoami
    www-data

    bumby:~$ psql -Umoseley newdb
    Welcome to psql 7.4.1, the PostgreSQL interactive terminal.

Now, to allow host connections (which is how my web application would
connect), add the "host" line:


    # TYPE  DATABASE    USER    IP-ADDRES   IP-MASK   METHOD
    local    newdb       all                          ident webaccess
    host     newdb       all 127.0.0.1 255.255.255.255 ident webaccess

I'm running Debian sid which didn't have ident running, so I installed
the ident2 package before this would work.


I'm just learning, but...

I doubt I would use this method.  Instead I'd use the md5 method
and load the password into the web server on startup (when running as
root).  That won't work with CGI programs, but will with mod_perl, for
example.  With the above method anyone with access to the web server can
access the newdb database.  Using a username and password also allows
GRANT permissions per user.




--
Bill Moseley
moseley@hank.org