I am working on setting up LDAP authentication for a PostgreSQL database and have added the following in my pg_hba.conf file:

host    all         all     all         ldap ldapurl="ldap://example.local/dc=example,dc=local?sAMAccountName" ldapbinddn="username" ldapbindpasswd="password"

It works! But now I'd like to store the username and password as environment variables, like I do for most of my config settings. I've tried adding the username and password as $LDAPUSERNAME or "$LDAPUSERNAME" but they aren't inserting any values. Is this possible?

Note: The database will be running in a docker container. If I have to run some script to process the pg_hba.conf file before starting the database, I can.

2 Answers 2


You cannot specify these settings via environment variables in PostgreSQL. Remember that ldapbindpasswd is specific to a certain pg_hba.conf line, and different lines could have different settings.

  • Yup, and storing them as different variables for each connection would have been sufficient if the feature were available. Thank you!
    – GammaGames
    Jan 20, 2022 at 15:30
  • I think there is a misconception. The whole processing is on the server, and an environment variable per connection can only be on the client. Jan 20, 2022 at 17:55
  • The database is running inside a docker container, so the environment variables are all set from a config file. This is just the credentials to bind to the LDAP server. I want to keep the username and password out of git.
    – GammaGames
    Jan 20, 2022 at 18:52
  • Use an LDAP user that has no sensitive permissions. How about anonymous bind? Jan 21, 2022 at 4:41
  • Anonymous binding is disabled, but we have created a user with no important permissions. Thank you!
    – GammaGames
    Jan 21, 2022 at 15:41

Since my final goal is to keep passwords out of version control and the database is running in a docker container, I made the image process the pg_hba.conf file on initialization.

  1. Create a .env file for the service with the contents:
LDAPCONFIG=ldapurl="ldap://example.local/dc=example,dc=local?sAMAccountName" ldapbinddn="username" ldapbindpasswd="password"

Add this file to your .gitignore so it is not committed.

  1. Edit the pg_hba.conf file with the environment variable:
host    all         all     all         ldap $LDAPCONFIG
  1. Add the following script (I have saved under scripts/ldap.sh) and update the dockerfile to copy the script into the initialization directory:
#!/usr/bin/env bash

echo "Setting up pg_hba.conf file"
cat /var/tmp/pg_hba.conf | envsubst > /var/lib/postgresql/data/pg_hba.conf
FROM postgres:14

RUN apt-get -y upgrade \
    && apt-get install -y gettext  # Dependency for envsubst command

COPY ./scripts/ldap.sh:/docker-entrypoint-initdb.d/10ldap.sh
COPY ./config/pg_hba.conf /var/tmp/pg_hba.conf

Note: This script will only run if the data directory is empty, and you will have to run the script if the container already has a database.

Now simply start your database and watch for any errors in the log!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.