POSTGRES_PASSWORD is required to be set when using POSTGRES_HOST_AUTH_METHOD=cert
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 38/100
Research direction
Start with docker-entrypoint.sh, especially docker_verify_minimum_env and pg_setup_hba_conf at the linked locations, to trace how POSTGRES_HOST_AUTH_METHOD is validated and written to pg_hba.conf. Define the supported certificate-authentication input, including any auth options or hostssl behavior, and consider how completion can be verified for the resulting configuration.
Written by the indexing model from the issue text.
Description
I'd like to be able to write a configuration that uses mutual TLS with the auth method cert, which does not require a password and instead enforces that the user is equal to the common name of the authenticated client certificate.
However, the only passwordless auth method permitted by by the docker entrypoint script's docker_verify_minimum_env function is trust:
It seems like adding another case to this check to allow for using certificate-based authentication. One concern I have, though, is that there are auth options as well that may be needed, e.g., looking at the pg_setup_hba_conf function below, it appears that if I want to end up with a pg_hba.conf file with cert clientcert=verify-full, that full string (i.e., including the auth options) would need to be set in the POSTGRES_HOST_AUTH_METHOD environment variable as written. I'm not sure if it would make more sense to add a new environment variable for that purpose? There is also no way that I can identify to use hostssl instead of host, though with cert authentication I'm not sure that actually matters.
- Dominant language
- Shell
- Stars
- 2.5k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker-library/postgres
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
docker-library/postgres#1420 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
docker-library/postgres#1419 · 2 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
docker-library/postgres#1389 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
docker-library/postgres#1356 · 5 comments · 7 reactions ·
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
docker-library/postgres#1355 · 10 comments · 11 reactions ·
All issues in docker-library/postgres
Similar issues
-
out-of-date
Difficulty 1/5 Under an hour Newbie friendliness 82/100
CachyOS/CachyOS-PKGBUILDS#1917 ·
Maintainers usually reply within 1 day
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
bug needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
EmbarkStudios/cargo-about#323 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
vllm-project/vllm-metal#841 ·
Maintainers usually reply within 1 day