Postgres + Ldap username mapping

Hi all,

I've been running in a quest that is driving me crazy.

The situation is:
1 - I have an LDAP user database with usernames composed by just numbers ex.: 82782355812
2 - I need my Postgres users to authenticate with this LDAP database
3 - I have a restriction that my Postgres users must have usernames starting with an alphabetical character, like a82782355812

I tried using pg_ident.conf to map the system user 82782355812 to a82782355812 with no success.

Here is my pg_hba.conf:

host all all 10.10.10.0/24 ldap "ldap://127.0.0.1/basedn;uid=;,cn=users,ou=ldapconfig,dc=mydomain,dc=com"
host all 82782355812 10.10.10.0/24 ident map=test

Here is my pg_ident.conf

test 82782355812 a82782355812

When my configuration is like this one above I get this on postgres log:

2013-02-06 12:22:42 BRST FATAL: role "82782355812" does not exist

When I invert those lines in pg_hba.conf I get this on postgres log:

2013-02-06 12:25:40 BRST FATAL: Ident authentication failed for user "82782355812"

If I have a normal user on LDAP (with an alpha char first in the username), and create the same role on postgres, I can authenticate with success. That implies postgres is authenticating well with LDAP.

The only thing is that my little restriction of having an user base of numbers as usernames needing to authenticate in postgres whit an alpha char prefix in the roles.

It could be that I can achieve this result with other methods than pg_ident.conf, but I'm not realizing which one...

I thought about a regex in the ldap connection string in pg_hba.conf, and custom pam modules with no result.

Do you think it is possible to achieve this result?

Thanks in advance
Alexandre

Anyone have a clue?

You might provide some details on your config/settings of the LDAP layer. I suspect your problem could be resolved by providing an attribute in the DN record that provides the mapping to usernames that begin with a alpha character, or to augment (or strip off) the numeric value with the "a" during bind connect.