postgresql/src/include/libpq/hba.h

/*-------------------------------------------------------------------------
 *
 * hba.h
 *	  Interface to hba.c
 *
 *
 * $PostgreSQL: pgsql/src/include/libpq/hba.h,v 1.43 2006/07/10 16:20:52 alvherre Exp $
 *
 *-------------------------------------------------------------------------
 */
#ifndef HBA_H
#define HBA_H

#include "nodes/pg_list.h"


typedef enum UserAuth
{
	uaReject,
	uaKrb5,
	uaTrust,
	uaIdent,
	uaPassword,
	uaCrypt,
	uaMD5
#ifdef USE_PAM
	,uaPAM
#endif   /* USE_PAM */
#ifdef USE_LDAP
    ,uaLDAP
#endif
} UserAuth;

typedef struct Port hbaPort;

extern List **get_role_line(const char *role);
extern void load_hba(void);
extern void load_ident(void);
extern void load_role(void);
extern int	hba_getauthmethod(hbaPort *port);
extern int	authident(hbaPort *port);
extern bool read_pg_database_line(FILE *fp, char *dbname, Oid *dboid,
					  Oid *dbtablespace, TransactionId *dbminxid,
					  TransactionId *dbvacuumxid);

#endif   /* HBA_H */
Prepare for new host-based authentication 1996-10-11 11:12:18 +02:00			`/*-------------------------------------------------------------------------`
			`*`
Change my-function-name-- to my_function_name, and optimizer renames. 1999-02-14 00:22:53 +01:00			`* hba.h`
Massive commit to run PGINDENT on all .c and .h files. 1997-09-07 07:04:48 +02:00			`* Interface to hba.c`
Prepare for new host-based authentication 1996-10-11 11:12:18 +02:00			`*`
			`*`
Improve vacuum code to track minimum Xids per table instead of per database. To this end, add a couple of columns to pg_class, relminxid and relvacuumxid, based on which we calculate the pg_database columns after each vacuum. We now force all databases to be vacuumed, even template ones. A backend noticing too old a database (meaning pg_database.datminxid is in danger of falling behind Xid wraparound) will signal the postmaster, which in turn will start an autovacuum iteration to process the offending database. In principle this is only there to cope with frozen (non-connectable) databases without forcing users to set them to connectable, but it could force regular user database to go through a database-wide vacuum at any time. Maybe we should warn users about this somehow. Of course the real solution will be to use autovacuum all the time ;-) There are some additional improvements we could have in this area: for example the vacuum code could be smarter about not updating pg_database for each table when called by autovacuum, and do it only once the whole autovacuum iteration is done. I updated the system catalogs documentation, but I didn't modify the maintenance section. Also having some regression tests for this would be nice but it's not really a very straightforward thing to do. Catalog version bumped due to system catalog changes. 2006-07-10 18:20:52 +02:00			`* $PostgreSQL: pgsql/src/include/libpq/hba.h,v 1.43 2006/07/10 16:20:52 alvherre Exp $`
Prepare for new host-based authentication 1996-10-11 11:12:18 +02:00			`*`
			`*-------------------------------------------------------------------------`
			`*/`
			`#ifndef HBA_H`
Massive commit to run PGINDENT on all .c and .h files. 1997-09-07 07:04:48 +02:00			`#define HBA_H`
Prepare for new host-based authentication 1996-10-11 11:12:18 +02:00
Authentication improvements: A new pg_hba.conf column, USER Allow specifiction of lists of users separated by commas Allow group names specified by + Allow include files containing lists of users specified by @ Allow lists of databases, and database files Allow samegroup in database column to match group name matching dbname Removal of secondary password files Remove pg_passwd utility Lots of code cleanup in user.c and hba.c New data/global/pg_pwd format New data/global/pg_group file 2002-04-04 06:25:54 +02:00			`#include "nodes/pg_list.h"`

Finish up the flat-files project: get rid of GetRawDatabaseInfo() hack in favor of looking at the flat file copy of pg_database during backend startup. This should finally eliminate the various corner cases in which backend startup fails unexpectedly because it isn't able to distinguish live and dead tuples in pg_database. Simplify locking on pg_database to be similar to the rules used with pg_shadow and pg_group, and eliminate FlushRelationBuffers operations that were used only to reduce the odds of failure of GetRawDatabaseInfo. initdb forced due to addition of a trigger to pg_database. 2005-02-26 19:43:34 +01:00
pgindent run before 6.3 release, with Thomas' requested changes. 1998-02-26 05:46:47 +01:00			`typedef enum UserAuth`
			`{`
Another pgindent run. Fixes enum indenting, and improves #endif spacing. Also adds space for one-line comments. 2001-10-28 07:26:15 +01:00			`uaReject,`
			`uaKrb5,`
			`uaTrust,`
			`uaIdent,`
			`uaPassword,`
			`uaCrypt,`
			`uaMD5`
Code review for MD5 authorization patch. Clean up some breakage (salts were always zero!?), add much missing documentation. 2001-09-21 22:31:49 +02:00			`#ifdef USE_PAM`
Another pgindent run. Fixes enum indenting, and improves #endif spacing. Also adds space for one-line comments. 2001-10-28 07:26:15 +01:00			`,uaPAM`
New pgindent run with fixes suggested by Tom. Patch manually reviewed, initdb/regression tests pass. 2001-11-05 18:46:40 +01:00			`#endif /* USE_PAM */`
This patch adds native LDAP auth, for those platforms that don't have PAM (such as Win32, but also unixen without PAM). On Unix, uses OpenLDAP. On win32, uses the builin WinLDAP library. Magnus Hagander 2006-03-06 18:41:44 +01:00			`#ifdef USE_LDAP`
			`,uaLDAP`
			`#endif`
From: Phil Thompson <phil@river-bank.demon.co.uk> I've completed the patch to fix the protocol and authentication issues I was discussing a couple of weeks ago. The particular changes are: - the protocol has a version number - network byte order is used throughout - the pg_hba.conf file is used to specify what method is used to authenticate a frontend (either password, ident, trust, reject, krb4 or krb5) - support for multiplexed backends is removed - appropriate changes to man pages - the -a switch to many programs to specify an authentication service no longer has any effect - the libpq.so version number has changed to 1.1 The new backend still supports the old protocol so old interfaces won't break. 1998-01-26 02:42:53 +01:00			`} UserAuth;`

Lots of patches coming in from me today :-) When drawing up a very simple "text-drawing" of how the negotiation is done, I realised I had done this last part (fallback) in a very stupid way. Patch #4 fixes this, and does it in a much better way. Included is also the simple text-drawing of how the negotiation is done. //Magnus 1999-09-27 05:13:16 +02:00			`typedef struct Port hbaPort;`

Replace pg_shadow and pg_group by new role-capable catalogs pg_authid and pg_auth_members. There are still many loose ends to finish in this patch (no documentation, no regression tests, no pg_dump support for instance). But I'm going to commit it now anyway so that Alvaro can make some progress on shared dependencies. The catalog changes should be pretty much done. 2005-06-28 07:09:14 +02:00			`extern List *get_role_line(const char role);`
Authentication improvements: A new pg_hba.conf column, USER Allow specifiction of lists of users separated by commas Allow group names specified by + Allow include files containing lists of users specified by @ Allow lists of databases, and database files Allow samegroup in database column to match group name matching dbname Removal of secondary password files Remove pg_passwd utility Lots of code cleanup in user.c and hba.c New data/global/pg_pwd format New data/global/pg_group file 2002-04-04 06:25:54 +02:00			`extern void load_hba(void);`
			`extern void load_ident(void);`
Replace pg_shadow and pg_group by new role-capable catalogs pg_authid and pg_auth_members. There are still many loose ends to finish in this patch (no documentation, no regression tests, no pg_dump support for instance). But I'm going to commit it now anyway so that Alvaro can make some progress on shared dependencies. The catalog changes should be pretty much done. 2005-06-28 07:09:14 +02:00			`extern void load_role(void);`
pgindent run on all C files. Java run to follow. initdb/regression tests pass. 2001-10-25 07:50:21 +02:00			`extern int hba_getauthmethod(hbaPort *port);`
			`extern int authident(hbaPort *port);`
Standard pgindent run for 8.1. 2005-10-15 04:49:52 +02:00			`extern bool read_pg_database_line(FILE fp, char dbname, Oid *dboid,`
Improve vacuum code to track minimum Xids per table instead of per database. To this end, add a couple of columns to pg_class, relminxid and relvacuumxid, based on which we calculate the pg_database columns after each vacuum. We now force all databases to be vacuumed, even template ones. A backend noticing too old a database (meaning pg_database.datminxid is in danger of falling behind Xid wraparound) will signal the postmaster, which in turn will start an autovacuum iteration to process the offending database. In principle this is only there to cope with frozen (non-connectable) databases without forcing users to set them to connectable, but it could force regular user database to go through a database-wide vacuum at any time. Maybe we should warn users about this somehow. Of course the real solution will be to use autovacuum all the time ;-) There are some additional improvements we could have in this area: for example the vacuum code could be smarter about not updating pg_database for each table when called by autovacuum, and do it only once the whole autovacuum iteration is done. I updated the system catalogs documentation, but I didn't modify the maintenance section. Also having some regression tests for this would be nice but it's not really a very straightforward thing to do. Catalog version bumped due to system catalog changes. 2006-07-10 18:20:52 +02:00			`Oid dbtablespace, TransactionId dbminxid,`
Standard pgindent run for 8.1. 2005-10-15 04:49:52 +02:00			`TransactionId *dbvacuumxid);`
Another pgindent run. Fixes enum indenting, and improves #endif spacing. Also adds space for one-line comments. 2001-10-28 07:26:15 +01:00
Standard pgindent run for 8.1. 2005-10-15 04:49:52 +02:00			`#endif /* HBA_H */`