*** src/backend/libpq/hba.c	2006-11-06 01:42:08.000000000 +0300
--- src/backend/libpq/hba.c	2006-11-16 15:42:29.000000000 +0300
***************
*** 1587,1593 ****
  int
  authident(hbaPort *port)
  {
! 	char		ident_user[IDENT_USERNAME_MAX + 1];
  
  	switch (port->raddr.addr.ss_family)
  	{
--- 1587,1594 ----
  int
  authident(hbaPort *port)
  {
! 	char		buf[IDENT_USERNAME_MAX + 1];
! 	char		*ident_user	= buf;
  
  	switch (port->raddr.addr.ss_family)
  	{
***************
*** 1595,1608 ****
--- 1596,1625 ----
  #ifdef	HAVE_IPV6
  		case AF_INET6:
  #endif
+ #ifdef	USE_SSL
+ 			if (port->peer != NULL)
+ 			{
+ 				ident_user = port->peer_dn;
+ 				ereport(DEBUG2,
+ 					(errmsg("Client SSL certificate subject identifies remote user as \"%s\"",
+ 						ident_user)));
+ 				break;
+ 			}
+ #endif
  			if (!ident_inet(port->raddr, port->laddr, ident_user))
  				return STATUS_ERROR;
+ 			ereport(DEBUG2,
+ 				(errmsg("Ident protocol identifies remote user as \"%s\"",
+ 					ident_user)));
  			break;
  
  #ifdef HAVE_UNIX_SOCKETS
  		case AF_UNIX:
  			if (!ident_unix(port->sock, ident_user))
  				return STATUS_ERROR;
+ 			ereport(DEBUG2,
+ 				(errmsg("Local kernel identifies user as \"%s\"",
+ 					ident_user)));
  			break;
  #endif
  
***************
*** 1610,1618 ****
  			return STATUS_ERROR;
  	}
  
- 	ereport(DEBUG2,
- 			(errmsg("Ident protocol identifies remote user as \"%s\"",
- 					ident_user)));
  
  	if (check_ident_usermap(port->auth_arg, port->user_name, ident_user))
  		return STATUS_OK;
--- 1627,1632 ----