Better document use of ident on localhost, per Tom Lane's idea.

diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml
index 7ba2a36e2c126fbb9e63a6127ae9746f4334789c..9067f5323974b7bebeb646186fa999b93a8784bb 100644 (file)
--- a/doc/src/sgml/client-auth.sgml
+++ b/doc/src/sgml/client-auth.sgml
@@ -1,4 +1,4 @@
-<!-- $Header: /cvsroot/pgsql/doc/src/sgml/client-auth.sgml,v 1.11 2001/05/12 22:51:34 petere Exp $ -->
+<!-- $Header: /cvsroot/pgsql/doc/src/sgml/client-auth.sgml,v 1.12 2001/07/11 20:32:10 momjian Exp $ -->
 
 <chapter id="client-authentication">
  <title>Client Authentication</title>
@@ -242,7 +242,10 @@ hostssl <replaceable>database</replaceable> <replaceable>IP-address</replaceable
           of the connecting user. <productname>Postgres</productname>
           then verifies whether the so identified operating system user
           is allowed to connect as the database user that is requested.
-         This is only available for TCP/IP connections.
+         This is only available for TCP/IP connections.  It can be used
+         on the local machine by specifying the localhost address 127.0.0.1.
+         </para>
+         <para>
           The <replaceable>authentication option</replaceable> following
           the <literal>ident</> keyword specifies the name of an
           <firstterm>ident map</firstterm> that specifies which operating
@@ -553,7 +556,8 @@ host         all        192.168.0.0    255.255.0.0        ident     omicron
      <attribution>RFC 1413</attribution>
      <para>
       The Identification Protocol is not intended as an authorization
-      or access control protocol.
+      or access control protocol.  You must trust the machine running the
+      ident server.
      </para>
     </blockquote>
    </para>

diff --git a/src/backend/libpq/pg_hba.conf.sample b/src/backend/libpq/pg_hba.conf.sample
index c6711fc08e0c2668e47afb6f062590d8b70ce419..d9c05feb12971446a4c44371a5651e254e0ce75f 100644 (file)
--- a/src/backend/libpq/pg_hba.conf.sample
+++ b/src/backend/libpq/pg_hba.conf.sample
@@ -1,5 +1,5 @@
 # 
-#                PostgreSQL HOST-BASED ACCESS (HBA) CONTROL FILE
+#                PostgreSQL HOST-BASED ACCESS (HBA) CONTROL FILE
 # 
 # 
 # This file controls:
@@ -101,9 +101,9 @@
 #              be use only for machines where all users are truested.
 # 
 #   password:  Authentication is done by matching a password supplied
-#              in clear by the host. If no AUTH_ARGUMENT is used, the
-#              password is compared with the user's entry in the
-#              pg_shadow table.
+#              in clear by the host. If no AUTH_ARGUMENT is used, the
+#              password is compared with the user's entry in the
+#              pg_shadow table.
 # 
 #              If AUTH_ARGUMENT is specified, the username is looked up
 #              in that file in the $PGDATA directory. If the username
@@ -118,30 +118,30 @@
 #              passwords.
 # 
 #   crypt:     Same as "password", but authentication is done by
-#              encrypting the password sent over the network. This is
-#              always preferable to "password" except for old clients
-#              that don't support "crypt". Also, crypt can use
-#              usernames stored in secondary password files but not
-#              secondary passwords.
-# 
-#   ident: Authentication is done by the ident server on the local 
-#              or remote host. AUTH_ARGUMENT is required and maps names 
-#              found in the $PGDATA/pg_ident.conf file. The connection
-#              is accepted if the file contains an entry for this map
-#              name with the ident-supplied username and the requested
-#              PostgreSQL username. The special map name "sameuser"
-#              indicates an implied map (not in pg_ident.conf) that
-#              maps each ident username to the identical PostgreSQL 
+#              encrypting the password sent over the network. This is
+#              always preferable to "password" except for old clients
+#              that don't support "crypt". Also, crypt can use
+#              usernames stored in secondary password files but not
+#              secondary passwords.
+# 
+#   ident:     Authentication is done by the ident server on the local
+#              (127.0.0.1) or remote host. AUTH_ARGUMENT is required and
+#              maps names found in the $PGDATA/pg_ident.conf file. The 
+#              connection is accepted if the file contains an entry for
+#              this map name with the ident-supplied username and the 
+#              requested PostgreSQL username. The special map name 
+#              "sameuser" indicates an implied map (not in pg_ident.conf)
+#              that maps each ident username to the identical PostgreSQL 
 #              username.
 # 
-#   krb4:      Kerberos V4 authentication is used.
+#   krb4:      Kerberos V4 authentication is used.
 # 
-#   krb5:      Kerberos V5 authentication is used.
+#   krb5:      Kerberos V5 authentication is used.
 # 
 #   reject:    Reject the connection. This is used to reject certain hosts
-#              that are part of a network specified later in the file.
-#              To be effective, "reject" must appear before the later
-#              entries.
+#              that are part of a network specified later in the file.
+#              To be effective, "reject" must appear before the later
+#              entries.
 # 
 # Local UNIX-domain socket connections support only the AUTH_TYPEs of
 # "trust", "password", "crypt", and "reject".