2

I am trying to use the 'ident' authentication of for local PostGIS (2.5) server, so that each user can connect to his/her account without having to provide password.

The local connection (to 127.0.0.1) worked if I use trust in /etc/postgresql/11/main/pg_hba.conf:

host    all             all             127.0.0.1/32            trust
host    all             all             ::1/128                 trust

, but fails when trust is replaced with ident and if connection is made from QGIS (3.8.1).

ident authentication failed for user

The strange thing is that I can connect successfully (with ident authentication) without giving user names or password, both from the command line client psql and from pyscopg2 using python. But QGIS3 connection fails.

From documentation:

ident

Obtain the operating system user name of the client by contacting the ident server on the client and check if it matches the requested database user name. Ident authentication can only be used on TCP/IP connections. When specified for local connections, peer authentication will be used instead. See Section 19.3.5 for details.

peer

Obtain the client's operating system user name from the operating system and check if it matches the requested database user name. This is only available for local connections. See Section 19.3.6 for details.

Is this a bug in QGIS? Or am I missing something in the QGIS or PostGIS configuration?

How can I get ident working for QGIS?

Note: I googled the issue, some suggest using other authentication method like md5. But I specifically need to ident behavior for multiple users. md5 requires password, and trust is not secure. I need each user to access his/her own database without password, without allowing access to any other databases.

  • 127.0.0.1 is only available on your machine you will need to use your public ip for other users to connect to that database. – Mapperz Aug 16 at 20:59
  • instead of 127.0.0.1/32 (your localhost for IPv4) or ::1 (your localhost for IPv6), have you ever try to change it into your LAN network like 192.168.0.1/16 or 172.16.0.1/12 or 10.0.0.1/8 to allow anyone in your LAN to play and mess with your DB? – Kampau Ocu Aug 16 at 21:26
  • @Kampau Ocu. I haven't and do not intend to allow network access from other machines. – tinlyx Aug 16 at 23:28
1

This ticket explains the issue, you need to use trust for QGis to work as it is explicitly setting the username in the connection.

By default PostgreSQL uses IDENT-based authentication and this will never allow you to login via -U and -W options. Allow username and password based authentication from your application by applying 'trust' as the authentication method for the JIRA database user. You can do this by modifying the pg_hba.conf file.

So you will either need to use trust or set up passwords (MD5) or other authentication system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.