diff options
| -rw-r--r-- | doc/src/sgml/client-auth.sgml | 95 |
1 files changed, 94 insertions, 1 deletions
diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml index 36e5a5d9a86..5f1eec78fb6 100644 --- a/doc/src/sgml/client-auth.sgml +++ b/doc/src/sgml/client-auth.sgml @@ -911,8 +911,101 @@ omicron bryanh guest1 <sect1 id="auth-methods"> <title>Authentication Methods</title> + + <para> + <productname>PostgreSQL</productname> provides various methods for + authenticating users: + + <itemizedlist> + <listitem> + <para> + <link linkend="auth-trust">Trust authentication</link>, which + simply trusts that users are who they say they are. + </para> + </listitem> + <listitem> + <para> + <link linkend="auth-password">Password authentication</link>, which + requires that users send a password. + </para> + </listitem> + <listitem> + <para> + <link linkend="gssapi-auth">GSSAPI authentication</link>, which + relies on a GSSAPI-compatible security library. Typically this is + used to access an authentication server such as a Kerberos or + Microsoft Active Directory server. + </para> + </listitem> + <listitem> + <para> + <link linkend="sspi-auth">SSPI authentication</link>, which + uses a Windows-specific protocol similar to GSSAPI. + </para> + </listitem> + <listitem> + <para> + <link linkend="auth-ident">Ident authentication</link>, which + relies on an <quote>Identification Protocol</quote> (RFC 1413) + service on the client's machine. (On local Unix-socket connections, + this is treated as peer authentication.) + </para> + </listitem> + <listitem> + <para> + <link linkend="auth-peer">Peer authentication</link>, which + relies on operating system facilities to identify the process at the + other end of a local connection. This is not supported for remote + connections. + </para> + </listitem> + <listitem> + <para> + <link linkend="auth-ldap">LDAP authentication</link>, which + relies on an LDAP authentication server. + </para> + </listitem> + <listitem> + <para> + <link linkend="auth-radius">RADIUS authentication</link>, which + relies on a RADIUS authentication server. + </para> + </listitem> + <listitem> + <para> + <link linkend="auth-cert">Certificate authentication</link>, which + requires an SSL connection and authenticates users by checking the + SSL certificate they send. + </para> + </listitem> + <listitem> + <para> + <link linkend="auth-pam">PAM authentication</link>, which + relies on a PAM (Pluggable Authentication Modules) library. + </para> + </listitem> + <listitem> + <para> + <link linkend="auth-bsd">BSD authentication</link>, which + relies on the BSD Authentication framework (currently available + only on OpenBSD). + </para> + </listitem> + </itemizedlist> + </para> + + <para> + Peer authentication is usually recommendable for local connections, + though trust authentication might be sufficient in some circumstances. + Password authentication is the easiest choice for remote connections. + All the other options require some kind of external security + infrastructure (usually an authentication server or a certificate + authority for issuing SSL certificates), or are platform-specific. + </para> + <para> - The following sections describe the authentication methods in more detail. + The following sections describe each of these authentication methods + in more detail. </para> </sect1> |