Fix pg_hba_file_rules for authentication method cert
For authentication method cert, clientcert=verify-full is implied. But
the pg_hba_file_rules entry would incorrectly show clientcert=verify-ca.
Per bug
Reported-By: Feike Steenbergen
Backpatch-through: 12
@@ -1632,7 +1632,11 @@ parse_hba_line(TokenizedLine *tok_line, int elevel)
*/
if (parsedline->auth_method == uaCert)
{
- parsedline->clientcert = clientCertCA;
+ /*
+ * For auth method cert, client certificate validation is mandatory, and it implies
+ * the level of verify-full.
+ */
+ parsedline->clientcert = clientCertFull;
}
return parsedline;
