How to troubleshoot "Ident authentication failed" errors connecting to PostGIS with Geoserver?

Question

In my production Geoserver (v2.11) instance, accessing layers that were working fine yesterday are now throwing the following error:

<ServiceException>
      Error occurred getting featuresUnable to obtain connection: Cannot create PoolableConnectionFactory (FATAL: Ident authentication failed for user "dpsdata")
Cannot create PoolableConnectionFactory (FATAL: Ident authentication failed for user "dpsdata")
FATAL: Ident authentication failed for user "dpsdata"
</ServiceException>

The connection to the PostGIS database both in PGAdmin and QGIS are working just fine.

Trying to connect to the data store yields the following error:

Error creating data store, check the parameters. Error message: Unable to obtain connection:  

Cannot create PoolableConnectionFactory (FATAL: Ident authentication failed for user "dpsdata")

However: Using my Dev Geoserver instance (v2.10) I can successfully connect to the same production PostGIS instance that throws errors in Prod - no errors are thrown, no users Ident authentication, and I can edit the data in QGIS, and see the new data showing up in an openlayers preview map.

What is going on with my Production Geoserver instance preventing me from connecting to and publishing maps my Dev Geoserver instance can do just fine? Also wondering what changed overnight that would have affected this, but my systems staff says nothing has happened on their end.

Any thoughts on what further to troubleshoot given the PostGIS database seems to be functioning just fine, and this looks to be some kind of Geoserver-only issue?

PostGIS version 2.3.3 PostgreSQL version 9.5 Apache Tomcat CentOS 6 Geoserver Dev v 2.10 Geoserver Prod v 2.11

(I also tried using my QA instance, also Geoserver v2.11, and the same issue is happening)

Answer 1

The solution turned out to be in the pg_hba.conf file, but we’re still not sure how it got changed to stop accepting connection from ONLY the prod machine…

From my systems staff:

The issue turned out to be the pg_hba.conf files was restricting the authentication method tomcat was trying to use.

This is what was in place originally:

# "local" is for Unix domain socket connections only
local   all             all                                     peer
# IPv4 local connections:
host    all             all             127.0.0.1/32            ident
# IPv6 local connections:
host    all             all             ::1/128                 ident
# Allow replication connections from localhost, by a user with the
# replication privilege.
#local   replication     postgres                                peer
#host    replication     postgres        127.0.0.1/32            ident
#host    replication     postgres        ::1/128                 ident
host     all             all             0.0.0.0/0               md5

I changed it to:

local   all             postgres                                peer
local   all             all                                     md5
# IPv4 local connections:
#host    all             all             127.0.0.1/32            ident
# IPv6 local connections:
#host    all             all             ::1/128                 ident
# Allow replication connections from localhost, by a user with the
# replication privilege.
#local   replication     postgres                                peer
#host    replication     postgres        127.0.0.1/32            ident
#host    replication     postgres        ::1/128                 ident
host     all             all             0.0.0.0/0               md5

Basically, I disabled IPv6, removed the 127.0.0.1/32 line (since it was conflicting with the catch-all host at the bottom), and I changed the default line from peer to md5, forcing the use of standard passwords for, and add the first "postgres" line to allow trusted logins to that user when logged in as 'postgres'