diff options
| -rw-r--r-- | src/backend/libpq/hba.c | 26 |
1 files changed, 13 insertions, 13 deletions
diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c index 7a935f34b58..97afce3e57a 100644 --- a/src/backend/libpq/hba.c +++ b/src/backend/libpq/hba.c @@ -1274,6 +1274,19 @@ parse_hba_line(List *line, int line_num, char *raw_line) return NULL; } + /* + * For GSS and SSPI, set the default value of include_realm to true. + * Having include_realm set to false is dangerous in multi-realm + * situations and is generally considered bad practice. We keep the + * capability around for backwards compatibility, but we might want to + * remove it at some point in the future. Users who still need to strip + * the realm off would be better served by using an appropriate regex in a + * pg_ident.conf mapping. + */ + if (parsedline->auth_method == uaGSS || + parsedline->auth_method == uaSSPI) + parsedline->include_realm = true; + /* Parse remaining arguments */ while ((field = lnext(field)) != NULL) { @@ -1376,19 +1389,6 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num) hbaline->ldapscope = LDAP_SCOPE_SUBTREE; #endif - /* - * For GSS and SSPI, set the default value of include_realm to true. - * Having include_realm set to false is dangerous in multi-realm - * situations and is generally considered bad practice. We keep the - * capability around for backwards compatibility, but we might want to - * remove it at some point in the future. Users who still need to strip - * the realm off would be better served by using an appropriate regex in a - * pg_ident.conf mapping. - */ - if (hbaline->auth_method == uaGSS || - hbaline->auth_method == uaSSPI) - hbaline->include_realm = true; - if (strcmp(name, "map") == 0) { if (hbaline->auth_method != uaIdent && |