@ -627,7 +627,7 @@ hostnogssenc <replaceable>database</replaceable> <replaceable>user</replaceabl
entire <literal>Distinguished Name (DN)</literal> of the certificate.
entire <literal>Distinguished Name (DN)</literal> of the certificate.
This option is probably best used in conjunction with a username map.
This option is probably best used in conjunction with a username map.
The comparison is done with the <literal>DN</literal> in
The comparison is done with the <literal>DN</literal> in
<ulink url="https://tools.ietf.org /html/rfc2253">RFC 2253</ulink>
<ulink url="https://datatracker.ietf.org/doc /html/rfc2253">RFC 2253</ulink>
format. To see the <literal>DN</literal> of a client certificate
format. To see the <literal>DN</literal> of a client certificate
in this format, do
in this format, do
<programlisting>
<programlisting>
@ -967,7 +967,7 @@ omicron bryanh guest1
<para>
<para>
<link linkend="auth-ident">Ident authentication</link>, which
<link linkend="auth-ident">Ident authentication</link>, which
relies on an <quote>Identification Protocol</quote>
relies on an <quote>Identification Protocol</quote>
(<ulink url="https://tools.ietf.org /html/rfc1413">RFC 1413</ulink>)
(<ulink url="https://datatracker.ietf.org/doc /html/rfc1413">RFC 1413</ulink>)
service on the client's machine. (On local Unix-socket connections,
service on the client's machine. (On local Unix-socket connections,
this is treated as peer authentication.)
this is treated as peer authentication.)
</para>
</para>
@ -1106,7 +1106,7 @@ omicron bryanh guest1
<para>
<para>
The method <literal>scram-sha-256</literal> performs SCRAM-SHA-256
The method <literal>scram-sha-256</literal> performs SCRAM-SHA-256
authentication, as described in
authentication, as described in
<ulink url="https://tools.ietf.org /html/rfc7677">RFC 7677</ulink>. It
<ulink url="https://datatracker.ietf.org/doc /html/rfc7677">RFC 7677</ulink>. It
is a challenge-response scheme that prevents password sniffing on
is a challenge-response scheme that prevents password sniffing on
untrusted connections and supports storing passwords on the server in a
untrusted connections and supports storing passwords on the server in a
cryptographically hashed form that is thought to be secure.
cryptographically hashed form that is thought to be secure.
@ -1218,7 +1218,7 @@ omicron bryanh guest1
<para>
<para>
<productname>GSSAPI</productname> is an industry-standard protocol
<productname>GSSAPI</productname> is an industry-standard protocol
for secure authentication defined in
for secure authentication defined in
<ulink url="https://tools.ietf.org /html/rfc2743">RFC 2743</ulink>.
<ulink url="https://datatracker.ietf.org/doc /html/rfc2743">RFC 2743</ulink>.
<productname>PostgreSQL</productname>
<productname>PostgreSQL</productname>
supports <productname>GSSAPI</productname> for authentication,
supports <productname>GSSAPI</productname> for authentication,
communications encryption, or both.
communications encryption, or both.
@ -1533,7 +1533,7 @@ omicron bryanh guest1
<para>
<para>
The <quote>Identification Protocol</quote> is described in
The <quote>Identification Protocol</quote> is described in
<ulink url="https://tools.ietf.org /html/rfc1413">RFC 1413</ulink>.
<ulink url="https://datatracker.ietf.org/doc /html/rfc1413">RFC 1413</ulink>.
Virtually every Unix-like
Virtually every Unix-like
operating system ships with an ident server that listens on TCP
operating system ships with an ident server that listens on TCP
port 113 by default. The basic functionality of an ident server
port 113 by default. The basic functionality of an ident server
@ -1702,7 +1702,7 @@ omicron bryanh guest1
<para>
<para>
Set to 1 to make the connection between PostgreSQL and the LDAP server
Set to 1 to make the connection between PostgreSQL and the LDAP server
use TLS encryption. This uses the <literal>StartTLS</literal>
use TLS encryption. This uses the <literal>StartTLS</literal>
operation per <ulink url="https://tools.ietf.org /html/rfc4513">RFC 4513</ulink>.
operation per <ulink url="https://datatracker.ietf.org/doc /html/rfc4513">RFC 4513</ulink>.
See also the <literal>ldapscheme</literal> option for an alternative.
See also the <literal>ldapscheme</literal> option for an alternative.
</para>
</para>
</listitem>
</listitem>
@ -1797,7 +1797,7 @@ omicron bryanh guest1
<term><literal>ldapurl</literal></term>
<term><literal>ldapurl</literal></term>
<listitem>
<listitem>
<para>
<para>
An <ulink url="https://tools.ietf.org /html/rfc4516">RFC 4516</ulink>
An <ulink url="https://datatracker.ietf.org/doc /html/rfc4516">RFC 4516</ulink>
LDAP URL. This is an alternative way to write some of the
LDAP URL. This is an alternative way to write some of the
other LDAP options in a more compact and standard form. The format is
other LDAP options in a more compact and standard form. The format is
<synopsis>
<synopsis>
@ -1860,7 +1860,7 @@ ldap[s]://<replaceable>host</replaceable>[:<replaceable>port</replaceable>]/<rep
<productname>OpenLDAP</productname> as the LDAP client library, the
<productname>OpenLDAP</productname> as the LDAP client library, the
<literal>ldapserver</literal> setting may be omitted. In that case, a
<literal>ldapserver</literal> setting may be omitted. In that case, a
list of host names and ports is looked up via
list of host names and ports is looked up via
<ulink url="https://tools.ietf.org /html/rfc2782">RFC 2782</ulink> DNS SRV records.
<ulink url="https://datatracker.ietf.org/doc /html/rfc2782">RFC 2782</ulink> DNS SRV records.
The name <literal>_ldap._tcp.DOMAIN</literal> is looked up, where
The name <literal>_ldap._tcp.DOMAIN</literal> is looked up, where
<literal>DOMAIN</literal> is extracted from <literal>ldapbasedn</literal>.
<literal>DOMAIN</literal> is extracted from <literal>ldapbasedn</literal>.
</para>
</para>