aws / aws/pg_tle

Additional parameter to clientauth_port_subset (clientauth)

Open
#290 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
C
Stars
410
Forks
41
Avg merge
18h 17m
Merged PRs (30d)
2

Description

## Describe the problem
Currently the clientauth_port_subset parameter takes set of parameters as described in https://github.com/aws/pg_tle/blob/main/docs/04_hooks.md
Parameter application_name would be a added security feature where customer can prevent unauthorized access by the front-end application like pgadmin/dbeaver etc. This parameter can also be used to add any additional details for auditing purpose.

* What are you trying to solve?
Additional security feature to prevent un-authorized access.

## Describe the proposal
Adding a new parameter to the clientauth_port_subset object

* What is the feature you are proposing?
* How would it solve the problem?

## Describe alternatives

* How would you solve the problem today if the feature is not built?
PostgreSQL 17 provides functionality of login triggers, but currently this feature is not available in previous versions.
* What other alternatives are there?
N/A

Contributor guide

Open the contributing guide

Research direction

Start with docs/04_hooks.md and the existing clientauth_port_subset definition, then review how PostgreSQL 17 login triggers expose application identity. Clarify the intended application_name semantics and security or auditing behavior before changing the implementation. Done should include documented parameter behavior and tests covering accepted values and unauthorized access prevention.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, postgresql
Domain
authentication, databases, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.