pgcat icon indicating copy to clipboard operation
pgcat copied to clipboard

Implement LDAP Authentication

Open AndrewJackson2020 opened this issue 1 year ago • 7 comments

This PR implements trust (no password), and LDAP authentication with pgcat. Postgres offers a number of authentication options that are not available with pgcat with trust being the most basic. Added a configuration item to allow the auth_type to be set at the user level.

AndrewJackson2020 avatar May 25 '24 02:05 AndrewJackson2020

@drdrsh any chance that this functionality could get merged in? Happy to make any changes, add documentation, tests, split up the PR(one for trust, one for LDAP), etc.

AndrewJackson2020 avatar Sep 01 '24 20:09 AndrewJackson2020

I haven't had the time to review this yet. I will take a look later this week or on the weekend.

drdrsh avatar Sep 03 '24 10:09 drdrsh

I will appreciate it if you could add some tests. I'll update the CONTRIBUTING file to show how you can add tests in Ruby/Python/Go/Rust and how you can run them locally.

drdrsh avatar Sep 03 '24 10:09 drdrsh

I updated the Contribution guide to show how you can write integration tests.

drdrsh avatar Sep 03 '24 16:09 drdrsh

Thank for updating those docs. Added some basic unit tests for LDAP and trust. Added onto the python unit tests since that is the testing framework that I am most familiar with.

One thing I notice is that the python tests are currently organized as a script, might be worth refactoring it to use pytest to get better reporting, test isolation, parallelism, amongst other things. I opened #790 which modifies the tests to use the pytest framework. If you want to go that route I can change the tests in this PR as well if/when you want to merge that.

Since LDAP requires a dedicated web service I incorporated GLauth in the docker container since it can be installed via a very straightforward binary. GLauth also provides a docker container as well (https://hub.docker.com/r/glauth/glauth) if this fits better with the pgcat testing framework.

AndrewJackson2020 avatar Sep 03 '24 20:09 AndrewJackson2020

I see the #790 was merged. Will work on converting these tests to use pytest today.

AndrewJackson2020 avatar Sep 05 '24 13:09 AndrewJackson2020

Just a heads up, removed the trust auth (passwordless) stuff out of this PR. Will raise a new PR with that stuff. I figure its easier that way as the LDAP functionality requires changes to the dockerfile (and thus the CI) in order to run whereas the trust functionality is a lot more limited in scope.

AndrewJackson2020 avatar Sep 07 '24 17:09 AndrewJackson2020