github.com/cockroachdb/cockroach@v20.2.0-alpha.1+incompatible/pkg/sql/pgwire/testdata/auth/trust_reject (about)

     1  config secure
     2  ----
     3  
     4  subtest auth_reject
     5  
     6  # Smoke test: the test user can log in.
     7  connect user=testuser
     8  ----
     9  ok defaultdb
    10  
    11  # With a 'reject' rule, they can't log in anymore even though a later
    12  # rule lets them.
    13  set_hba
    14  host all testuser all reject
    15  host all all all cert-password
    16  ----
    17  # Active authentication configuration on this node:
    18  # Original configuration:
    19  # host  all root all cert-password # CockroachDB mandatory rule
    20  # host all testuser all reject
    21  # host all all all cert-password
    22  #
    23  # Interpreted configuration:
    24  # TYPE DATABASE USER     ADDRESS METHOD        OPTIONS
    25  host   all      root     all     cert-password
    26  host   all      testuser all     reject
    27  host   all      all      all     cert-password
    28  
    29  connect user=testuser
    30  ----
    31  ERROR: authentication rejected by configuration
    32  
    33  subtest end
    34  
    35  
    36  subtest auth_trust
    37  
    38  # Create a user with a seemingly required password.
    39  sql
    40  CREATE USER nocert WITH PASSWORD 'required'
    41  ----
    42  ok
    43  
    44  # Use the "trust" auth type to auth the user even without
    45  # a valid cert or password.
    46  set_hba
    47  host all nocert all trust
    48  host all all all cert
    49  ----
    50  # Active authentication configuration on this node:
    51  # Original configuration:
    52  # host  all root all cert-password # CockroachDB mandatory rule
    53  # host all nocert all trust
    54  # host all all all cert
    55  #
    56  # Interpreted configuration:
    57  # TYPE DATABASE USER   ADDRESS METHOD        OPTIONS
    58  host   all      root   all     cert-password
    59  host   all      nocert all     trust
    60  host   all      all    all     cert
    61  
    62  
    63  connect user=nocert sslcert= sslmode=require
    64  ----
    65  ok defaultdb
    66  
    67  subtest auth_trust/inexistent_user
    68  
    69  # If the user does not exist, a "trust" rule is not sufficient to
    70  # authorize a login.
    71  
    72  sql
    73  DROP USER nocert
    74  ----
    75  ok
    76  
    77  connect user=nocert sslcert= sslmode=require
    78  ----
    79  ERROR: password authentication failed for user nocert
    80  
    81  
    82  subtest end
    83  
    84  subtest end