0

I am working on setting up LDAP authentication for a PostgreSQL database and have added the following in my pg_hba.conf file:

# TYPE  DATABASE    USER    ADDRESS     METHOD
host    all         all     all         ldap ldapurl="ldap://example.local/dc=example,dc=local?sAMAccountName" ldapbinddn="username" ldapbindpasswd="password"

It works! But now I'd like to store the username and password as environment variables, like I do for most of my config settings. I've tried adding the username and password as $LDAPUSERNAME or "$LDAPUSERNAME" but they aren't inserting any values. Is this possible?

Note: The database will be running in a docker container. If I have to run some script to process the pg_hba.conf file before starting the database, I can.

Improve this question

2 Answers 2

Reset to default
1

You cannot specify these settings via environment variables in PostgreSQL. Remember that ldapbindpasswd is specific to a certain pg_hba.conf line, and different lines could have different settings.

Improve this answer
5
  • Yup, and storing them as different variables for each connection would have been sufficient if the feature were available. Thank you!
    – GammaGames
    Commented Jan 20, 2022 at 15:30
  • I think there is a misconception. The whole processing is on the server, and an environment variable per connection can only be on the client.
    – Laurenz Albe
    Commented Jan 20, 2022 at 17:55
  • The database is running inside a docker container, so the environment variables are all set from a config file. This is just the credentials to bind to the LDAP server. I want to keep the username and password out of git.
    – GammaGames
    Commented Jan 20, 2022 at 18:52
  • Use an LDAP user that has no sensitive permissions. How about anonymous bind?
    – Laurenz Albe
    Commented Jan 21, 2022 at 4:41
  • Anonymous binding is disabled, but we have created a user with no important permissions. Thank you!
    – GammaGames
    Commented Jan 21, 2022 at 15:41
0

Since my final goal is to keep passwords out of version control and the database is running in a docker container, I made the image process the pg_hba.conf file on initialization.

  1. Create a .env file for the service with the contents:
LDAPCONFIG=ldapurl="ldap://example.local/dc=example,dc=local?sAMAccountName" ldapbinddn="username" ldapbindpasswd="password"

Add this file to your .gitignore so it is not committed.

  1. Edit the pg_hba.conf file with the environment variable:
# TYPE  DATABASE    USER    ADDRESS     METHOD
host    all         all     all         ldap $LDAPCONFIG
  1. Add the following script (I have saved under scripts/ldap.sh) and update the dockerfile to copy the script into the initialization directory:
#!/usr/bin/env bash

echo "Setting up pg_hba.conf file"
cat /var/tmp/pg_hba.conf | envsubst > /var/lib/postgresql/data/pg_hba.conf

FROM postgres:14

RUN apt-get -y upgrade \
    && apt-get install -y gettext  # Dependency for envsubst command

COPY ./scripts/ldap.sh:/docker-entrypoint-initdb.d/10ldap.sh
COPY ./config/pg_hba.conf /var/tmp/pg_hba.conf

Note: This script will only run if the data directory is empty, and you will have to run the script if the container already has a database.

Now simply start your database and watch for any errors in the log!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.