title: postgres jdbc client cert user vs db user
body: <h2>Backstory:</h2>
  
  <p>I've gotten jdbc to connect to postgres using a client cert.  In java I set the user in the properties, and the driver looks it up in the keystore and sends it along.  All was good.</p>
  
  <p>But I just found out that I won't be getting certs with a CN of pg-user.  The certs I'll be getting will have a CN of pg-user.XYZ.foo.com &amp; pg-user.ABC.foo.com.  This looks like a job for <a href="http://www.postgresql.org/docs/9.1/static/auth-username-maps.html" rel="nofollow">username maps</a>.  Hey they even have regexp, it'll be perfect.</p>
  
  <p>I got unix user root logging in to postgres as pg-user using a username map and local ident authentication using <code>psql -d db -U pg-user</code>.  But in that case postgres knows <strong>BOTH</strong> that the user is root, <strong>AND</strong> is trying to log in as pg-user.</p>
  
  <h2>Problem:</h2>
  
  <p>What I can't figure out is how to tell the <a href="http://mvnrepository.com/artifact/org.postgresql/postgresql/9.4-1201-jdbc41" rel="nofollow">postgres jdbc driver</a> to grab the cert from the keystore with a CN of pg-user.XYZ.foo.com, but present to postgres as user pg-user.  It appears to be the single argument of <code>user</code> that controls both.  Does anyone know how to do this?</p>
  
  <p><a href="https://jdbc.postgresql.org/documentation/80/connect.html" rel="nofollow">This page</a> includes a list of the connection options, but it doesn't seem to offer a way to split the user names.  The closest I'm seeing is the option to write my own sslfactory, and I'm <strong>really</strong> hoping to avoid that...</p>