Configuring Authentication

# TYPE  DATABASE  USER       METHOD
local   all       postgres   peer
local   all       all        scram-sha-256

# TYPE  DATABASE  USER  ADDRESS         METHOD
host    all       all   127.0.0.1/32    scram-sha-256
host    all       all   ::1/128         scram-sha-256
host    all       all   10.0.0.0/8      scram-sha-256
hostssl prod      app   0.0.0.0/0       scram-sha-256

SHOW password_encryption;          -- should be 'scram-sha-256' (default)
ALTER SYSTEM SET password_encryption = 'scram-sha-256';
ALTER USER alice PASSWORD 'S3cret!';   -- stored as SCRAM verifier

# pg_hba.conf
local   all   all   peer map=usermap
# pg_ident.conf
# MAPNAME  SYSTEM-USERNAME  PG-USERNAME
usermap    deploy           app_user

hostssl all all 0.0.0.0/0 cert clientcert=verify-full

host all all 0.0.0.0/0 ldap \
  ldapserver=ldap.example.com \
  ldapprefix="uid=" ldapsuffix=",ou=People,dc=example,dc=com"

# Search+bind mode
host all all 0.0.0.0/0 ldap \
  ldapserver=ldap.example.com ldapbasedn="dc=example,dc=com" \
  ldapbinddn="cn=svc,dc=example,dc=com" ldapbindpasswd="..." \
  ldapsearchattribute="uid"

SELECT pg_reload_conf();
-- Inspect parsed rules
SELECT line_number, type, database, user_name, address, auth_method, error
  FROM pg_hba_file_rules;