PostgreSQL login with x509 certificate

Question

I have web application based on pyramid, where users authenticating themselves against Postgresql database with passwords. Now I want to change login/password to smartcards. How can I login users to Postgres in such scenario ?

Answer 1

You only need to create a function that will accept JWT or x509, validate it, create a "phantom user" that corresponds with the roles of that identity, then run the SQL with that user.

I'm not familiar with Pyramid, but it should be possible to configure or modify that framework to use such a strategy. Furthermore, a Public Web Service API endpoint can be defined, and then even a front-end javascript can directly query with SQL.