Skip to content

feat(db): require password for local IP connections#313

Closed
vkrizan wants to merge 1 commit intotheforeman:masterfrom
vkrizan:iop-fdw
Closed

feat(db): require password for local IP connections#313
vkrizan wants to merge 1 commit intotheforeman:masterfrom
vkrizan:iop-fdw

Conversation

@vkrizan
Copy link
Copy Markdown
Contributor

@vkrizan vkrizan commented Jul 8, 2025

Requires password authentication to pg for local IP connections in order to support Foreign Data Wrapper connections to the same instance.

Please note, that the unix socket connections are unaffected by this change.

Having a FDW to localhost with full trust results in:

ERROR:  password is required
DETAIL:  Non-superuser cannot connect if the server does not request a password.
HINT:  Target server's authentication method must be changed or password_required=false set in the user mapping attributes. 

@vkrizan
Copy link
Copy Markdown
Contributor Author

vkrizan commented Jul 9, 2025

@ehelms looks like this breaks something? Should I just add inventory_db and leave the rest untouched?

@ehelms
Copy link
Copy Markdown
Member

ehelms commented Jul 9, 2025

@ehelms looks like this breaks something? Should I just add inventory_db and leave the rest untouched?

Will the same be required for advisor?

@vkrizan
Copy link
Copy Markdown
Contributor Author

vkrizan commented Jul 10, 2025

Will the same be required for advisor?

@ehelms This will be shared for everything that needs to grab data from Inventory db, Advisor included. The trick here is to require password for the database/user it is connecting to (via foreign table).

@vkrizan
Copy link
Copy Markdown
Contributor Author

vkrizan commented Jul 11, 2025

@ehelms I've reworked it to just add inventory_db to the list. The tests are pending for some reason, and the previous run (with previous changes) had some meaningless output (which seemed like generated from AI, considering the emojis):


📝 Job statuses:
📝 unit → ✓ success [required to succeed]
📝 acceptance → ❌ failure [required to succeed]
Error: Process completed with exit code 1.

This is required to have FDW to localhost working, as the security
mechanism prevents passwordless connections.
@vkrizan
Copy link
Copy Markdown
Contributor Author

vkrizan commented Jul 14, 2025

@ehelms PTAL 🙏

@ehelms
Copy link
Copy Markdown
Member

ehelms commented Jul 14, 2025

@ehelms PTAL 🙏

I do not know what PTAL is. I have not merged this yet because this needs more changes for IoP to work in devel than just this change and I wanted to encompass all of them. I have been working on that over here -- ehelms@35f635f

@ehelms ehelms closed this Jul 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants