You should definitely read the section on "Client Authentication"19.1 Client Authentication in the PostgreSQL manualPostgreSQL manual to better understand the authentication settings available (for each record in pg_hba.confpg_hba.conf), but here is the relevant snippet to help with the problem you're having (from the version 8.4 manualversion 9.5 manual):
trust
Allow the connection unconditionally. This method allows anyone that can connect to the PostgreSQL database server to login as any PostgreSQL user they likewish, without the need for a password or any other authentication. See Section 19.3.1 for details.
reject
Reject the connection unconditionally. This is useful for "filtering out" certain hosts from a group, for example a reject line could block a specific host from connecting, while a later line allows the remaining hosts in a specific network to connect.
md5
Require the client to supply an MD5a double-encryptedMD5-hashed password for authentication. See Section 19.3.2 for details.
password
Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 19.3.2 for details.
gss
Use GSSAPI to authenticate the user. This is only available for TCP/IP connections. See Section 19.3.3 for details.
sspi
Use SSPI to authenticate the user. This is only available on Windows.
krb5
Use Kerberos V5 to authenticate the user See Section 19. This is only available3.4 for TCP/IP connections details.
ident
Obtain the operating system user name of the client (for TCP/IP connections by contacting the ident ident server on the client, and check if it matches the requested database user name. Ident authentication can only be used on TCP/IP connections. When specified for local connections, peer authentication connections by getting it fromwill be used instead. See Section 19.3.5 for details.
peer
Obtain the client's operating system) user name from the operating system and check if it matches matches the requested database user name. This is only available for local connections. See Section 19.3.6 for details.
ldap
Authenticate using an LDAP server. See Section 19.3.7 for details.
radius
Authenticate using a RADIUS server. See Section 19.3.8 for details.
cert
Authenticate using SSL client certificates. See Section 19.3.9 for details.
pam
Authenticate using the Pluggable Authentication Modules (PAM) service provided by the operating system. See Section 19.3.10 for details.
So ... to solve the problem you're experiencing, you could either:
a) Change the authentication method(s) defined in your pg_hba.conf file to trust, md5, or password (depending on your security and simplicity needs) for the local connection records you have defined in there.
b) Update pg_ident.conf to map your operating system users to PostgreSQL users and grant themdo one of the corresponding access privileges, depending on your needs.following:
c) Leave the IDENT settings alone and create users in your database for each operating system user that you want to grant access to. If a user is already authenticated by the OS and logged in, PostgreSQL won't require further authentication and will grant access to that user based on whatever privileges (roles) are assigned to it in the database. This is the default configuration.
Change the authentication method(s) defined in your
pg_hba.conffile totrust,md5, orpassword(depending on your security and simplicity needs) for the local connection records you have defined in there.Update
pg_ident.confto map your operating system users to PostgreSQL users and grant them the corresponding access privileges, depending on your needs.Leave the IDENT settings alone and create users in your database for each operating system user that you want to grant access to. If a user is already authenticated by the OS and logged in, PostgreSQL won't require further authentication and will grant access to that user based on whatever privileges (roles) are assigned to it in the database. This is the default configuration.
