pg_hba_lookup function to get all matching pg_hba.conf entries

*** a/doc/src/sgml/func.sgml
--- b/doc/src/sgml/func.sgml
***************
*** 16576,16581 **** SELECT collation for ('foo' COLLATE "de_DE");
--- 16576,16594 ----
         <entry><type>text</type></entry>
         <entry>set parameter and return new value</entry>
        </row>
+ 	  <row>
+        <entry>
+         <indexterm>
+          <primary>pg_hba_lookup</primary>
+         </indexterm>
+         <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+ 							<parameter>user</> <type>text</>
+ 							[, <parameter>address</> <type>text</>]
+ 							[, <parameter>hostname</> <type>text</>)</function></literal>
+        </entry>
+        <entry><type>record</type></entry>
+        <entry>Returns authentication method of the matching entry found in pg_hba.conf</entry>
+       </row>
       </tbody>
      </tgroup>
     </table>
***************
*** 16633,16638 **** SELECT set_config('log_statement_stats', 'off', false);
--- 16646,16665 ----
  </programlisting>
     </para>
  
+    <para>
+     <function>pg_hba_lookup</function> returns first matching
+ 	entry authentication method in pg_hba.conf with the given
+ 	input values. Typical usages include:
+ <programlisting>
+ SELECT pg_hba_lookup('test_database', 'test_user');
+ 
+  pg_hba_lookup 
+ ---------------
+  trust
+ (1 row)
+ </programlisting>
+    </para>
+    
    </sect2>
  
    <sect2 id="functions-admin-signal">
*** a/src/backend/libpq/hba.c
--- b/src/backend/libpq/hba.c
***************
*** 28,38 ****
--- 28,40 ----
  #include "catalog/pg_collation.h"
  #include "libpq/ip.h"
  #include "libpq/libpq.h"
+ #include "miscadmin.h"
  #include "postmaster/postmaster.h"
  #include "regex/regex.h"
  #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "utils/acl.h"
+ #include "utils/builtins.h"
  #include "utils/guc.h"
  #include "utils/lsyscache.h"
  #include "utils/memutils.h"
***************
*** 74,79 **** typedef struct HbaToken
--- 76,84 ----
  	bool		quoted;
  } HbaToken;
  
+ /* Flag to indicate the failure of reloading pg_hba.conf file */
+ bool		load_hba_failure = false;
+ 
  /*
   * pre-parsed content of HBA config file: list of HbaLine structs.
   * parsed_hba_context is the memory context where it lives.
***************
*** 99,104 **** static List *tokenize_inc_file(List *tokens, const char *outer_filename,
--- 104,110 ----
  				  const char *inc_filename);
  static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
  				   int line_num);
+ static bool pg_hba_match(HbaLine *hba, char *user, char *database, char *address, char *hostname);
  
  /*
   * isblank() exists in the ISO C99 spec, but it's not very portable yet,
***************
*** 2233,2235 **** hba_getauthmethod(hbaPort *port)
--- 2239,2382 ----
  {
  	check_hba(port);
  }
+ 
+ 
+ static bool
+ pg_hba_match(HbaLine *hba, char *user, char *database, char *address, char *hostname)
+ {
+ 	Oid			roleid;
+ 
+ 	/* Get the target role's OID.  Note we do not error out for bad role. */
+ 	roleid = get_role_oid(user, true);
+ 
+ 	if (!check_db(database, user, roleid, hba->databases))
+ 		return false;
+ 
+ 	if (!check_role(user, roleid, hba->roles))
+ 		return false;
+ 
+ 	return true;
+ }
+ 
+ 
+ /*
+ * SQL-accessible SRF to return all the settings from the pg_hba.conf
+ * file.
+ */
+ Datum
+ pg_hba_lookup_2args(PG_FUNCTION_ARGS)
+ {
+ 	return pg_hba_lookup(fcinfo);
+ }
+ 
+ /*
+  * SQL-accessible SRF to return all the settings from the pg_hba.conf
+  * file. 
+  */
+ Datum
+ pg_hba_lookup(PG_FUNCTION_ARGS)
+ {
+ 	char	*user;
+ 	char	*database;
+ 	char	*address;
+ 	char    *hostname;
+ 	ListCell   *line;
+ 
+ 	if (!superuser())
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+ 				 (errmsg("only superuser can view pg_hba.conf settings"))));
+ 
+ 	if (PG_ARGISNULL(0))
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+ 				(errmsg("user name is required to match pg_hba configuration entry"))));
+ 	else
+ 		user = TextDatumGetCString(PG_GETARG_DATUM(0));
+ 
+ 	if (PG_ARGISNULL(1))
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+ 				(errmsg("database name is required to match pg_hba configuration entry"))));
+ 	else
+ 		database = TextDatumGetCString(PG_GETARG_DATUM(1));
+ 
+ 	if (PG_NARGS() != 2)
+ 	{
+ 		if (!PG_ARGISNULL(2))
+ 			address = TextDatumGetCString(PG_GETARG_DATUM(2));
+ 
+ 		if (!PG_ARGISNULL(3))
+ 			hostname = TextDatumGetCString(PG_GETARG_DATUM(3));
+ 	}
+ 
+ 	if (load_hba_failure)
+ 		ereport(WARNING,
+ 				(errmsg("There was some failure in reloading pg_hba.conf file. "
+ 				"The pg_hba.conf settings data may contains stale information")));
+ 
+ 	/*
+ 	* Loop through the list and deparse each entry as it comes, storing it in
+ 	* the tuplestore. Any temporary memory allocations here live only for the
+ 	* function call lifetime.
+ 	*/
+ 	foreach(line, parsed_hba_lines)
+ 	{
+ 		HbaLine    *hba = (HbaLine *)lfirst(line);
+ 		Datum		value;
+ 
+ 		CHECK_FOR_INTERRUPTS();
+ 
+ 		if (pg_hba_match(hba, user, database, address, hostname))
+ 		{
+ 			switch (hba->auth_method)
+ 			{
+ 			case uaReject:
+ 				value = CStringGetTextDatum("reject");
+ 				break;
+ 			case uaTrust:
+ 				value = CStringGetTextDatum("trust");
+ 				break;
+ 			case uaIdent:
+ 				value = CStringGetTextDatum("ident");
+ 				break;
+ 			case uaPassword:
+ 				value = CStringGetTextDatum("password");
+ 				break;
+ 			case uaMD5:
+ 				value = CStringGetTextDatum("md5");
+ 				break;
+ 			case uaGSS:
+ 				value = CStringGetTextDatum("gss");
+ 				break;
+ 			case uaSSPI:
+ 				value = CStringGetTextDatum("sspi");
+ 				break;
+ 			case uaPAM:
+ 				value = CStringGetTextDatum("pam");
+ 				break;
+ 			case uaLDAP:
+ 				value = CStringGetTextDatum("ldap");
+ 				break;
+ 			case uaCert:
+ 				value = CStringGetTextDatum("cert");
+ 				break;
+ 			case uaRADIUS:
+ 				value = CStringGetTextDatum("radius");
+ 				break;
+ 			case uaPeer:
+ 				value = CStringGetTextDatum("peer");
+ 				break;
+ 			default:
+ 				elog(ERROR, "unexpected authentication method in parsed HBA entry");
+ 				break;
+ 			}
+ 
+ 			PG_RETURN_TEXT_P(value);
+ 		}
+ 	}
+ 
+ 	PG_RETURN_NULL();
+ }
+ 
+ 
*** a/src/backend/tcop/postgres.c
--- b/src/backend/tcop/postgres.c
***************
*** 4005,4010 **** PostgresMain(int argc, char *argv[],
--- 4005,4023 ----
  		{
  			got_SIGHUP = false;
  			ProcessConfigFile(PGC_SIGHUP);
+ 			
+ 			/* 
+ 			 * Reload authentication config files too to refresh 
+ 			 * pg_hba_conf view data.
+ 			 */
+ 			if (!load_hba())
+ 			{
+ 				ereport(DEBUG1,
+ 					(errmsg("Falure in reloading pg_hba.conf, pg_hba_conf view may show stale information")));
+ 				load_hba_failure = true;
+ 			}
+ 			
+ 			load_hba_failure = false;
  		}
  
  		/*
*** a/src/include/catalog/pg_proc.h
--- b/src/include/catalog/pg_proc.h
***************
*** 3079,3084 **** DATA(insert OID = 2084 (  pg_show_all_settings	PGNSP PGUID 12 1 1000 0 0 f f f f
--- 3079,3088 ----
  DESCR("SHOW ALL as a function");
  DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
  DESCR("show config file settings");
+ DATA(insert OID = 3997 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 2 0 25 "25 25" _null_ _null_ _null_ _null_ _null_ pg_hba_lookup_2args _null_ _null_ _null_));
+ DESCR("view client authentication settings");
+ DATA(insert OID = 3998 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 4 0 25 "25 25 25 25" _null_ _null_ _null_ _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+ DESCR("view client authentication settings");
  DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
  DESCR("view system lock information");
  DATA(insert OID = 1065 (  pg_prepared_xact PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{28,25,1184,26,26}" "{o,o,o,o,o}" "{transaction,gid,prepared,ownerid,dbid}" _null_ _null_ pg_prepared_xact _null_ _null_ _null_ ));
*** a/src/include/libpq/hba.h
--- b/src/include/libpq/hba.h
***************
*** 96,101 **** typedef struct IdentLine
--- 96,103 ----
  /* kluge to avoid including libpq/libpq-be.h here */
  typedef struct Port hbaPort;
  
+ extern bool load_hba_failure;
+ 
  extern bool load_hba(void);
  extern bool load_ident(void);
  extern void hba_getauthmethod(hbaPort *port);
*** a/src/include/utils/builtins.h
--- b/src/include/utils/builtins.h
***************
*** 1122,1127 **** extern Datum show_config_by_name_missing_ok(PG_FUNCTION_ARGS);
--- 1122,1129 ----
  extern Datum set_config_by_name(PG_FUNCTION_ARGS);
  extern Datum show_all_settings(PG_FUNCTION_ARGS);
  extern Datum show_all_file_settings(PG_FUNCTION_ARGS);
+ extern Datum pg_hba_lookup_2args(PG_FUNCTION_ARGS);
+ extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
  
  /* rls.c */
  extern Datum row_security_active(PG_FUNCTION_ARGS);

*** a/doc/src/sgml/func.sgml
--- b/doc/src/sgml/func.sgml
***************
*** 16576,16581 **** SELECT collation for ('foo' COLLATE "de_DE");
--- 16576,16594 ----
         <entry><type>text</type></entry>
         <entry>set parameter and return new value</entry>
        </row>
+ 	  <row>
+        <entry>
+         <indexterm>
+          <primary>pg_hba_lookup</primary>
+         </indexterm>
+         <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+ 							<parameter>user</> <type>text</>
+ 							[, <parameter>address</> <type>text</>]
+ 							[, <parameter>hostname</> <type>text</>)</function></literal>
+        </entry>
+        <entry><type>record</type></entry>
+        <entry>Returns all matching row entries of pg_hba.conf</entry>
+       </row>
       </tbody>
      </tgroup>
     </table>
***************
*** 16633,16638 **** SELECT set_config('log_statement_stats', 'off', false);
--- 16646,16667 ----
  </programlisting>
     </para>
  
+    <para>
+     <function>pg_hba_lookup</function> returns a set of records
+ 	containing the line number, type, database, user, address,
+ 	hostname, method and options that are satisfied with the given
+ 	input values. Typical usages include:
+ <programlisting>
+ SELECT pg_hba_lookup('test_database', 'test_user');
+ 
+ 					pg_hba_lookup
+ --------------------------------------------------------------
+  (84,local,"[""all""]","[""all""]",,,trust,{})
+  (86,local,"[""test_database""]","[""test_user""]",,,trust,{})
+ (1 row)
+ </programlisting>
+    </para>
+    
    </sect2>
  
    <sect2 id="functions-admin-signal">
*** a/src/backend/libpq/hba.c
--- b/src/backend/libpq/hba.c
***************
*** 25,39 ****
--- 25,45 ----
  #include <arpa/inet.h>
  #include <unistd.h>
  
+ #include "access/htup_details.h"
  #include "catalog/pg_collation.h"
+ #include "catalog/pg_type.h"
+ #include "funcapi.h"
  #include "libpq/ip.h"
  #include "libpq/libpq.h"
+ #include "miscadmin.h"
  #include "postmaster/postmaster.h"
  #include "regex/regex.h"
  #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "utils/acl.h"
+ #include "utils/builtins.h"
  #include "utils/guc.h"
+ #include "utils/jsonb.h"
  #include "utils/lsyscache.h"
  #include "utils/memutils.h"
  
***************
*** 74,79 **** typedef struct HbaToken
--- 80,95 ----
  	bool		quoted;
  } HbaToken;
  
+ typedef enum hba_lookup_args_mode
+ {
+ 	TWO_ARGS_MODE=0,
+ 	THREE_ARGS_MODE,
+ 	FOUR_ARGS_MODE
+ }hba_lookup_args_mode;
+ 
+ /* Flag to indicate the failure of reloading pg_hba.conf file */
+ bool		load_hba_failure = false;
+ 
  /*
   * pre-parsed content of HBA config file: list of HbaLine structs.
   * parsed_hba_context is the memory context where it lives.
***************
*** 100,105 **** static List *tokenize_inc_file(List *tokens, const char *outer_filename,
--- 116,125 ----
  static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
  				   int line_num);
  
+ static void hba_getvalues_for_line(HbaLine *hba, Datum *values, bool *nulls);
+ static bool pg_hba_match(HbaLine *hba, char *database, char *user,  struct sockaddr_storage *addr,
+ 				char *hostname, bool ssl_inuse, hba_lookup_args_mode args_mode);
+ 
  /*
   * isblank() exists in the ISO C99 spec, but it's not very portable yet,
   * so provide our own version.
***************
*** 2233,2235 **** hba_getauthmethod(hbaPort *port)
--- 2253,2826 ----
  {
  	check_hba(port);
  }
+ 
+ 
+ /* LDAP supports 10 currently, keep this well above the most any method needs */
+ #define MAX_OPTIONS 12
+ 
+ /*
+  * Fill in suitable values to build a tuple representing the
+  * HbaLine provided
+  */
+ static void
+ hba_getvalues_for_line(HbaLine *hba, Datum *values, bool *nulls)
+ {
+ 	int			index = 0;
+ 	JsonbInState result;
+ 	JsonbValue	v;
+ 	char	   *str;
+ 	int			len;
+ 
+ 	/* line_number */
+ 	values[index] = Int32GetDatum(hba->linenumber);
+ 
+ 	/* method */
+  	index++;
+  	switch (hba->auth_method)
+  	{
+  		case uaReject:
+  			values[index] = CStringGetTextDatum("reject");
+  			break;
+  		case uaTrust:
+  			values[index] = CStringGetTextDatum("trust");
+  			break;
+  		case uaIdent:
+  			values[index] = CStringGetTextDatum("ident");
+  			break;
+  		case uaPassword:
+  			values[index] = CStringGetTextDatum("password");
+  			break;
+  		case uaMD5:
+  			values[index] = CStringGetTextDatum("md5");
+  			break;
+  		case uaGSS:
+  			values[index] = CStringGetTextDatum("gss");
+  			break;
+  		case uaSSPI:
+  			values[index] = CStringGetTextDatum("sspi");
+  			break;
+  		case uaPAM:
+  			values[index] = CStringGetTextDatum("pam");
+  			break;
+  		case uaLDAP:
+  			values[index] = CStringGetTextDatum("ldap");
+  			break;
+  		case uaCert:
+  			values[index] = CStringGetTextDatum("cert");
+  			break;
+  		case uaRADIUS:
+  			values[index] = CStringGetTextDatum("radius");
+  			break;
+  		case uaPeer:
+  			values[index] = CStringGetTextDatum("peer");
+  			break;
+  		default:
+  			elog(ERROR, "unexpected authentication method in parsed HBA entry");
+  			break;
+  	}
+ 
+ 	/* options */
+ 	index++;
+ 	memset(&result, 0, sizeof(JsonbInState));
+ 	result.res = pushJsonbValue(&result.parseState, WJB_BEGIN_OBJECT, NULL);
+ 
+ 	if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
+ 	{
+ 		if (hba->include_realm)
+ 		{
+ 			str = pstrdup("include_realm");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(BoolGetDatum(true), false, &result, BOOLOID, false);
+ 		}
+ 
+ 		if (hba->krb_realm)
+ 		{
+ 			str = pstrdup("krb_realm");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->krb_realm), false, &result, TEXTOID, false);
+ 		}
+ 	}
+ 
+ 	if (hba->usermap)
+ 	{
+ 		str = pstrdup("map");
+ 		len = strlen(str);
+ 
+ 		v.type = jbvString;
+ 
+ 		v.val.string.len = len;
+ 		v.val.string.val = str;
+ 
+ 		result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 		add_jsonb(CStringGetTextDatum(hba->usermap), false, &result, TEXTOID, false);
+ 	}
+ 
+ 	if (hba->auth_method == uaLDAP)
+ 	{
+ 		if (hba->ldapserver)
+ 		{
+ 			str = pstrdup("ldapserver");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->ldapserver), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->ldapport)
+ 		{
+ 			str = pstrdup("ldapport");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(Int32GetDatum(hba->ldapport), false, &result, INT4OID, false);
+ 		}
+ 
+ 		if (hba->ldaptls)
+ 		{
+ 			str = pstrdup("ldaptls");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(BoolGetDatum(true), false, &result, BOOLOID, false);
+ 		}
+ 
+ 		if (hba->ldapprefix)
+ 		{
+ 			str = pstrdup("ldapprefix");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->ldapprefix), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->ldapsuffix)
+ 		{
+ 			str = pstrdup("ldapsuffix");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->ldapsuffix), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->ldapbasedn)
+ 		{
+ 			str = pstrdup("ldapbasedn");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->ldapbasedn), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->ldapbinddn)
+ 		{
+ 			str = pstrdup("ldapbinddn");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->ldapbinddn), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->ldapbindpasswd)
+ 		{
+ 			str = pstrdup("ldapbindpasswd");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->ldapbindpasswd), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->ldapsearchattribute)
+ 		{
+ 			str = pstrdup("ldapsearchattribute");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->ldapsearchattribute), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->ldapscope)
+ 		{
+ 			str = pstrdup("ldapscope");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(Int32GetDatum(hba->ldapscope), false, &result, INT4OID, false);
+ 		}
+ 	}
+ 
+ 	if (hba->auth_method == uaRADIUS)
+ 	{
+ 		if (hba->radiusserver)
+ 		{
+ 			str = pstrdup("radiusserver");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->radiusserver), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->radiussecret)
+ 		{
+ 			str = pstrdup("radiussecret");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->radiussecret), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->radiusidentifier)
+ 		{
+ 			str = pstrdup("radiusidentifier");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->radiusidentifier), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->radiusport)
+ 		{
+ 			str = pstrdup("radiusport");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(Int32GetDatum(hba->radiusport), false, &result, INT4OID, false);
+ 		}
+ 	}
+ 
+ 	result.res = pushJsonbValue(&result.parseState, WJB_END_OBJECT, NULL);
+ 	values[index] = PointerGetDatum(JsonbValueToJsonb(result.res));
+ }
+ 
+ static bool
+ pg_hba_match(HbaLine *hba, char *database, char *user, struct sockaddr_storage *addr,
+ 			char *hostname, bool ssl_inuse, hba_lookup_args_mode args_mode)
+ {
+ 	Oid			roleid;
+ 
+ 	if (ssl_inuse)
+ 	{
+ #ifdef USE_SSL
+ 		if (EnableSSL && hba->conntype != ctHostSSL)
+ 		{
+ 			ereport(NOTICE, (errmsg("Skipped %d Hba line, because of non SSL connection type.",
+ 					hba->linenumber)));
+ 			return false;
+ 		}
+ 		else
+ 		{
+ 			ereport(ERROR,
+ 					(errcode(ERRCODE_CONFIG_FILE_ERROR),
+ 					 errmsg("hostssl requires SSL to be turned on"),
+ 					 errhint("Set ssl = on in postgresql.conf.")));
+ 			return false;
+ 		}
+ #else
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_CONFIG_FILE_ERROR),
+ 				 errmsg("hostssl is not supported by this build"),
+ 		  errhint("Compile with --with-openssl to use SSL connections.")));
+ 		return false;
+ #endif
+ 	}
+ 
+ 	/* Get the target role's OID.  Note we do not error out for bad role. */
+ 	roleid = get_role_oid(user, true);
+ 
+ 	if (!check_db(database, user, roleid, hba->databases))
+ 	{
+ 		ereport(NOTICE, (errmsg("Skipped %d Hba line, because of non matching database.",
+ 				hba->linenumber)));
+ 		return false;
+ 	}
+ 
+ 	if (!check_role(user, roleid, hba->roles))
+ 	{
+ 		ereport(NOTICE, (errmsg("Skipped %d Hba line, because of non matching role.",
+ 				hba->linenumber)));
+ 		return false;
+ 	}
+ 
+ 	if (args_mode != TWO_ARGS_MODE)
+ 	{
+ 		/* Check IP address */
+ 		switch (hba->ip_cmp_method)
+ 		{
+ 			case ipCmpMask:
+ 				if (hostname && hba->hostname)
+ 				{
+ 					if (!hostname_match(hostname, hba->hostname))
+ 					{
+ 						ereport(NOTICE, (errmsg("Skipped %d Hba line, because of non matching hostname.",
+ 								hba->linenumber)));
+ 						return false;
+ 					}
+ 				}
+ 				else
+ 				{
+ 					if (!check_ip((SockAddr *)addr,
+ 								  (struct sockaddr *) & hba->addr,
+ 								  (struct sockaddr *) & hba->mask))
+ 					{
+ 						ereport(NOTICE, (errmsg("Skipped %d Hba line, because of non matching IP.",
+ 								hba->linenumber)));
+ 						return false;
+ 					}
+ 				}
+ 				break;
+ 			case ipCmpAll:
+ 				break;
+ 			case ipCmpSameHost:
+ 			case ipCmpSameNet:
+ 				if (!check_same_host_or_net((SockAddr *)addr,
+ 											hba->ip_cmp_method))
+ 				{
+ 					ereport(NOTICE, (errmsg("Skipped %d Hba line, because of non matching SameHost/SameNet.",
+ 							hba->linenumber)));
+ 					return false;
+ 				}
+ 				break;
+ 			default: /* Not reachable case*/
+ 				break;
+ 		}
+ 	}
+ 
+ 	return true;
+ }
+ 
+ /*
+  * SQL-accessible SRF to return all the settings from the pg_hba.conf
+  * file.
+  */
+ Datum
+ pg_hba_lookup_2args(PG_FUNCTION_ARGS)
+ {
+ 	return pg_hba_lookup(fcinfo);
+ }
+ 
+ /*
+  * SQL-accessible SRF to return all the settings from the pg_hba.conf
+  * file.
+  */
+ Datum
+ pg_hba_lookup_3args(PG_FUNCTION_ARGS)
+ {
+ 	return pg_hba_lookup(fcinfo);
+ }
+ 
+ #define NUM_PG_HBA_CONF_ATTS   3
+ 
+ /*
+  * SQL-accessible SRF to return all the settings from the pg_hba.conf
+  * file. 
+  */
+ Datum
+ pg_hba_lookup(PG_FUNCTION_ARGS)
+ {
+ 	char	*user;
+ 	char	*database;
+ 	char	*address = NULL;
+ 	bool    ssl_inuse = false;
+ 	TupleDesc	tupdesc;
+ 	ListCell   *line;
+ 	Datum		values[NUM_PG_HBA_CONF_ATTS];
+ 	bool		nulls[NUM_PG_HBA_CONF_ATTS];
+ 	HeapTuple	tuple;
+ 	Datum		result;
+ 	struct sockaddr_storage addr;
+ 	char *hostname = NULL;
+ 	hba_lookup_args_mode args_mode = TWO_ARGS_MODE; /* Minimum number of arguments */
+ 
+ 	if (!superuser())
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+ 				 (errmsg("only superuser can view pg_hba.conf settings"))));
+ 
+ 	if (PG_ARGISNULL(0))
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+ 				(errmsg("database name is required to match pg_hba configuration entry"))));
+ 	else
+ 		database = TextDatumGetCString(PG_GETARG_DATUM(0));
+ 
+ 	if (PG_ARGISNULL(1))
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+ 				(errmsg("user name is required to match pg_hba configuration entry"))));
+ 	else
+ 		user = TextDatumGetCString(PG_GETARG_DATUM(1));
+ 
+ 	if (PG_NARGS() != 2)
+ 	{
+ 		struct addrinfo *gai_result;
+ 		struct addrinfo hints;
+ 		int ret;
+ 
+ 		args_mode = THREE_ARGS_MODE;
+ 		if (!PG_ARGISNULL(2))
+ 			address = TextDatumGetCString(PG_GETARG_DATUM(2));
+ 
+ 		/* Get the IP address either way */
+ 		hints.ai_flags = AI_NUMERICHOST;
+ 		hints.ai_family = AF_UNSPEC;
+ 		hints.ai_socktype = 0;
+ 		hints.ai_protocol = 0;
+ 		hints.ai_addrlen = 0;
+ 		hints.ai_canonname = NULL;
+ 		hints.ai_addr = NULL;
+ 		hints.ai_next = NULL;
+ 
+ 		ret = pg_getaddrinfo_all(address, NULL, &hints, &gai_result);
+ 		if (ret == 0 && gai_result)
+ 			memcpy(&addr, gai_result->ai_addr, gai_result->ai_addrlen);
+ 		else if (ret == EAI_NONAME)
+ 			hostname = pstrdup(address);
+ 		else
+ 		{
+ 			ereport(ERROR,
+ 					(errmsg("invalid IP address \"%s\": %s",
+ 							 address, gai_strerror(ret))));
+ 			if (gai_result)
+ 				pg_freeaddrinfo_all(hints.ai_family, gai_result);
+ 			return false;
+ 		}
+ 
+ 		pg_freeaddrinfo_all(hints.ai_family, gai_result);
+ 
+ 		if (PG_NARGS() != 3)
+ 		{
+ 			args_mode = FOUR_ARGS_MODE;
+ 			if (!PG_ARGISNULL(3))
+ 				ssl_inuse = DatumGetBool(PG_GETARG_DATUM(3));
+ 		}
+ 	}
+ 
+ 	if (load_hba_failure)
+ 		ereport(WARNING,
+ 				(errmsg("There was some failure in reloading pg_hba.conf file. "
+ 				"The pg_hba.conf settings data may contains stale information")));
+ 
+ 	/* Create the tupledesc	*/
+ 	tupdesc = CreateTemplateTupleDesc(NUM_PG_HBA_CONF_ATTS, false);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)1, "line_number",
+ 		INT4OID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)2, "method",
+ 		TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)3, "options",
+ 		JSONBOID, -1, 0);
+ 	BlessTupleDesc(tupdesc);
+ 
+ 	MemSet(values, 0, sizeof(values));
+ 	MemSet(nulls, true, sizeof(nulls));
+ 
+ 	/*
+ 	 * Loop through the list and deparse each entry as it comes, and returns
+ 	 * the first matched entry.
+ 	 */
+ 	foreach(line, parsed_hba_lines)
+ 	{
+ 		HbaLine    *hba = (HbaLine *)lfirst(line);
+ 
+ 		CHECK_FOR_INTERRUPTS();
+ 
+ 		if (pg_hba_match(hba, database, user, &addr, hostname, ssl_inuse, args_mode))
+ 		{
+ 			/* Get the next parsed hba line values */
+ 			MemSet(nulls, false, sizeof(nulls));
+ 			hba_getvalues_for_line(hba, values, nulls);
+ 			break;
+ 		}
+ 	}
+ 
+ 	/* build a tuple */
+ 	tuple = heap_form_tuple(tupdesc, values, nulls);
+ 
+ 	/* make the tuple into a datum */
+ 	result = HeapTupleGetDatum(tuple);
+ 	PG_RETURN_DATUM(result);
+ }
+ 
+ 
*** a/src/backend/tcop/postgres.c
--- b/src/backend/tcop/postgres.c
***************
*** 4005,4010 **** PostgresMain(int argc, char *argv[],
--- 4005,4023 ----
  		{
  			got_SIGHUP = false;
  			ProcessConfigFile(PGC_SIGHUP);
+ 			
+ 			/* 
+ 			 * Reload authentication config files too to refresh 
+ 			 * pg_hba_conf view data.
+ 			 */
+ 			if (!load_hba())
+ 			{
+ 				ereport(DEBUG1,
+ 					(errmsg("Falure in reloading pg_hba.conf, pg_hba_conf view may show stale information")));
+ 				load_hba_failure = true;
+ 			}
+ 			
+ 			load_hba_failure = false;
  		}
  
  		/*
*** a/src/backend/utils/adt/jsonb.c
--- b/src/backend/utils/adt/jsonb.c
***************
*** 28,39 ****
  #include "utils/syscache.h"
  #include "utils/typcache.h"
  
- typedef struct JsonbInState
- {
- 	JsonbParseState *parseState;
- 	JsonbValue *res;
- } JsonbInState;
- 
  /* unlike with json categories, we need to treat json and jsonb differently */
  typedef enum					/* type categories for datum_to_jsonb */
  {
--- 28,33 ----
***************
*** 83,89 **** static void jsonb_categorize_type(Oid typoid,
  static void datum_to_jsonb(Datum val, bool is_null, JsonbInState *result,
  			   JsonbTypeCategory tcategory, Oid outfuncoid,
  			   bool key_scalar);
! static void add_jsonb(Datum val, bool is_null, JsonbInState *result,
  		  Oid val_type, bool key_scalar);
  static JsonbParseState *clone_parse_state(JsonbParseState *state);
  static char *JsonbToCStringWorker(StringInfo out, JsonbContainer *in, int estimated_len, bool indent);
--- 77,83 ----
  static void datum_to_jsonb(Datum val, bool is_null, JsonbInState *result,
  			   JsonbTypeCategory tcategory, Oid outfuncoid,
  			   bool key_scalar);
! void add_jsonb(Datum val, bool is_null, JsonbInState *result,
  		  Oid val_type, bool key_scalar);
  static JsonbParseState *clone_parse_state(JsonbParseState *state);
  static char *JsonbToCStringWorker(StringInfo out, JsonbContainer *in, int estimated_len, bool indent);
***************
*** 1113,1119 **** composite_to_jsonb(Datum composite, JsonbInState *result)
   * lookups only once.
   */
  
! static void
  add_jsonb(Datum val, bool is_null, JsonbInState *result,
  		  Oid val_type, bool key_scalar)
  {
--- 1107,1113 ----
   * lookups only once.
   */
  
! void
  add_jsonb(Datum val, bool is_null, JsonbInState *result,
  		  Oid val_type, bool key_scalar)
  {
*** a/src/include/catalog/pg_proc.h
--- b/src/include/catalog/pg_proc.h
***************
*** 3079,3084 **** DATA(insert OID = 2084 (  pg_show_all_settings	PGNSP PGUID 12 1 1000 0 0 f f f f
--- 3079,3090 ----
  DESCR("SHOW ALL as a function");
  DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
  DESCR("show config file settings");
+ DATA(insert OID = 3997 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f t t v u 2 0 2249 "25 25" "{25,25,23,25,3802}" "{i,i,o,o,o}" "{database,user,line_number,method,options}" _null_ _null_ pg_hba_lookup_2args _null_ _null_ _null_));
+ DESCR("view client authentication settings");
+ DATA(insert OID = 3998 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f t t v u 3 0 2249 "25 25 25" "{25,25,25,23,25,3802}" "{i,i,i,o,o,o}" "{database,user,address,line_number,method,options}" _null_ _null_ pg_hba_lookup_3args _null_ _null_ _null_));
+ DESCR("view client authentication settings");
+ DATA(insert OID = 3999 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f t t v u 4 0 2249 "25 25 25 16" "{25,25,25,16,23,25,3802}" "{i,i,i,i,o,o,o}" "{database,user,address,ssl_inuse,line_number,method,options}" _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+ DESCR("view client authentication settings");
  DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
  DESCR("view system lock information");
  DATA(insert OID = 1065 (  pg_prepared_xact PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{28,25,1184,26,26}" "{o,o,o,o,o}" "{transaction,gid,prepared,ownerid,dbid}" _null_ _null_ pg_prepared_xact _null_ _null_ _null_ ));
*** a/src/include/libpq/hba.h
--- b/src/include/libpq/hba.h
***************
*** 96,101 **** typedef struct IdentLine
--- 96,103 ----
  /* kluge to avoid including libpq/libpq-be.h here */
  typedef struct Port hbaPort;
  
+ extern bool load_hba_failure;
+ 
  extern bool load_hba(void);
  extern bool load_ident(void);
  extern void hba_getauthmethod(hbaPort *port);
*** a/src/include/utils/builtins.h
--- b/src/include/utils/builtins.h
***************
*** 1123,1128 **** extern Datum set_config_by_name(PG_FUNCTION_ARGS);
--- 1123,1133 ----
  extern Datum show_all_settings(PG_FUNCTION_ARGS);
  extern Datum show_all_file_settings(PG_FUNCTION_ARGS);
  
+ /* hba.c */
+ extern Datum pg_hba_lookup_2args(PG_FUNCTION_ARGS);
+ extern Datum pg_hba_lookup_3args(PG_FUNCTION_ARGS);
+ extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
+ 
  /* rls.c */
  extern Datum row_security_active(PG_FUNCTION_ARGS);
  extern Datum row_security_active_name(PG_FUNCTION_ARGS);
*** a/src/include/utils/json.h
--- b/src/include/utils/json.h
***************
*** 43,49 **** extern Datum json_object(PG_FUNCTION_ARGS);
  extern Datum json_object_two_arg(PG_FUNCTION_ARGS);
  
  extern void escape_json(StringInfo buf, const char *str);
- 
  extern Datum json_typeof(PG_FUNCTION_ARGS);
  
  /* functions in jsonfuncs.c */
--- 43,48 ----
*** a/src/include/utils/jsonb.h
--- b/src/include/utils/jsonb.h
***************
*** 343,348 **** typedef struct JsonbIterator
--- 343,354 ----
  	struct JsonbIterator *parent;
  } JsonbIterator;
  
+ typedef struct JsonbInState
+ {
+ 	JsonbParseState *parseState;
+ 	JsonbValue *res;
+ } JsonbInState;
+ 
  /* I/O routines */
  extern Datum jsonb_in(PG_FUNCTION_ARGS);
  extern Datum jsonb_out(PG_FUNCTION_ARGS);
***************
*** 428,433 **** extern bool JsonbDeepContains(JsonbIterator **val,
--- 434,441 ----
  extern void JsonbHashScalarValue(const JsonbValue *scalarVal, uint32 *hash);
  
  /* jsonb.c support functions */
+ void add_jsonb(Datum val, bool is_null, JsonbInState *result,
+ 	Oid val_type, bool key_scalar);
  extern char *JsonbToCString(StringInfo out, JsonbContainer *in,
  			   int estimated_len);
  extern char *JsonbToCStringIndent(StringInfo out, JsonbContainer *in,
*** a/src/test/regress/expected/rules.out
--- b/src/test/regress/expected/rules.out
***************
*** 1327,1332 **** pg_group| SELECT pg_authid.rolname AS groname,
--- 1327,1344 ----
            WHERE (pg_auth_members.roleid = pg_authid.oid)) AS grolist
     FROM pg_authid
    WHERE (NOT pg_authid.rolcanlogin);
+ pg_hba_conf| SELECT a.line_number,
+     a.type,
+     a.keyword_databases,
+     a.databases,
+     a.keyword_users,
+     a.users,
+     a.address,
+     a.compare_method,
+     a.hostname,
+     a.method,
+     a.options
+    FROM pg_hba_conf() a(line_number, type, keyword_databases, databases, keyword_users, users, address, compare_method, hostname, method, options);
  pg_indexes| SELECT n.nspname AS schemaname,
      c.relname AS tablename,
      i.relname AS indexname,

*** a/doc/src/sgml/func.sgml
--- b/doc/src/sgml/func.sgml
***************
*** 16576,16581 **** SELECT collation for ('foo' COLLATE "de_DE");
--- 16576,16594 ----
         <entry><type>text</type></entry>
         <entry>set parameter and return new value</entry>
        </row>
+ 	  <row>
+        <entry>
+         <indexterm>
+          <primary>pg_hba_lookup</primary>
+         </indexterm>
+         <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+ 							<parameter>user</> <type>text</>
+ 							[, <parameter>address</> <type>text</>]
+ 							[, <parameter>hostname</> <type>text</>)</function></literal>
+        </entry>
+        <entry><type>record</type></entry>
+        <entry>Returns all matching row entries of pg_hba.conf</entry>
+       </row>
       </tbody>
      </tgroup>
     </table>
***************
*** 16633,16638 **** SELECT set_config('log_statement_stats', 'off', false);
--- 16646,16667 ----
  </programlisting>
     </para>
  
+    <para>
+     <function>pg_hba_lookup</function> returns a set of records
+ 	containing the line number, type, database, user, address,
+ 	hostname, method and options that are satisfied with the given
+ 	input values. Typical usages include:
+ <programlisting>
+ SELECT pg_hba_lookup('test_database', 'test_user');
+ 
+ 					pg_hba_lookup
+ --------------------------------------------------------------
+  (84,local,"[""all""]","[""all""]",,,trust,{})
+  (86,local,"[""test_database""]","[""test_user""]",,,trust,{})
+ (1 row)
+ </programlisting>
+    </para>
+    
    </sect2>
  
    <sect2 id="functions-admin-signal">
*** a/src/backend/libpq/hba.c
--- b/src/backend/libpq/hba.c
***************
*** 25,39 ****
--- 25,45 ----
  #include <arpa/inet.h>
  #include <unistd.h>
  
+ #include "access/htup_details.h"
  #include "catalog/pg_collation.h"
+ #include "catalog/pg_type.h"
+ #include "funcapi.h"
  #include "libpq/ip.h"
  #include "libpq/libpq.h"
+ #include "miscadmin.h"
  #include "postmaster/postmaster.h"
  #include "regex/regex.h"
  #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "utils/acl.h"
+ #include "utils/builtins.h"
  #include "utils/guc.h"
+ #include "utils/jsonb.h"
  #include "utils/lsyscache.h"
  #include "utils/memutils.h"
  
***************
*** 74,79 **** typedef struct HbaToken
--- 80,95 ----
  	bool		quoted;
  } HbaToken;
  
+ typedef enum hba_lookup_args_mode
+ {
+ 	TWO_ARGS_MODE=0,
+ 	THREE_ARGS_MODE,
+ 	FOUR_ARGS_MODE
+ }hba_lookup_args_mode;
+ 
+ /* Flag to indicate the failure of reloading pg_hba.conf file */
+ bool		load_hba_failure = false;
+ 
  /*
   * pre-parsed content of HBA config file: list of HbaLine structs.
   * parsed_hba_context is the memory context where it lives.
***************
*** 100,105 **** static List *tokenize_inc_file(List *tokens, const char *outer_filename,
--- 116,128 ----
  static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
  				   int line_num);
  
+ static void hba_getvalues_for_line(HbaLine *hba, Datum *values, bool *nulls,
+ 			bool hba_match_result);
+ static bool pg_hba_match(HbaLine *hba, char *user, char *database, struct sockaddr_storage *addr,
+ 		 				char *hostname, bool ssl_inuse, hba_lookup_args_mode args_mode);
+ static void pg_hba_lookup_internal(char	*database, char	*user, struct sockaddr_storage *addr,
+ 			char *hostname, bool ssl_inuse, hba_lookup_args_mode args_mode, ReturnSetInfo *rsi);
+ 
  /*
   * isblank() exists in the ISO C99 spec, but it's not very portable yet,
   * so provide our own version.
***************
*** 2233,2235 **** hba_getauthmethod(hbaPort *port)
--- 2256,2969 ----
  {
  	check_hba(port);
  }
+ 
+ 
+ /* LDAP supports 10 currently, keep this well above the most any method needs */
+ #define MAX_OPTIONS 12
+ 
+ /*
+  * Fill in suitable values to build a tuple representing the
+  * HbaLine provided
+  */
+ static void
+ hba_getvalues_for_line(HbaLine *hba, Datum *values, bool *nulls, bool hba_match_result)
+ {
+ 	ListCell   *dbcell;
+ 	char		buffer[NI_MAXHOST];
+ 	int			index = 0;
+ 	JsonbInState result;
+ 	JsonbValue	v;
+ 	char	   *str;
+ 	int			len;
+ 
+ 	/* line_number */
+ 	values[index] = Int32GetDatum(hba->linenumber);
+ 
+ 	/* type */
+ 	index++;
+  	switch (hba->conntype)
+  	{
+  		case ctLocal:
+  			values[index] = CStringGetTextDatum("local");
+  			break;
+  		case ctHost:
+  			values[index] = CStringGetTextDatum("host");
+  			break;
+  		case ctHostSSL:
+  			values[index] = CStringGetTextDatum("hostssl");
+  			break;
+  		case ctHostNoSSL:
+  			values[index] = CStringGetTextDatum("hostnossl");
+  			break;
+  		default:
+  			elog(ERROR, "unexpected connection type in parsed HBA entry");
+  			break;
+  	}
+ 
+ 	/* database */
+ 	index++;
+ 	memset(&result, 0, sizeof(JsonbInState));
+ 
+ 	result.res = pushJsonbValue(&result.parseState, WJB_BEGIN_ARRAY, NULL);
+ 
+ 	if (list_length(hba->databases) != 0)
+ 	{
+ 		HbaToken   *tok;
+ 
+ 		foreach(dbcell, hba->databases)
+ 		{
+ 			tok = lfirst(dbcell);
+ 			add_jsonb(CStringGetTextDatum(tok->string), false, &result, TEXTOID, false);
+ 		}
+ 	}
+ 
+ 	result.res = pushJsonbValue(&result.parseState, WJB_END_ARRAY, NULL);
+ 	values[index] = PointerGetDatum(JsonbValueToJsonb(result.res));
+ 
+ 	/* user */
+ 	index++;
+ 	memset(&result, 0, sizeof(JsonbInState));
+ 	result.res = pushJsonbValue(&result.parseState, WJB_BEGIN_ARRAY, NULL);
+ 
+ 	if (list_length(hba->roles) != 0)
+ 	{
+ 		HbaToken   *tok;
+ 
+ 		foreach(dbcell, hba->roles)
+ 		{
+ 			tok = lfirst(dbcell);
+ 			add_jsonb(CStringGetTextDatum(tok->string), false, &result, TEXTOID, false);
+ 		}
+ 	}
+ 
+ 	result.res = pushJsonbValue(&result.parseState, WJB_END_ARRAY, NULL);
+ 	values[index] = PointerGetDatum(JsonbValueToJsonb(result.res));
+ 
+ 	/* address */
+ 	index++;
+ 	if (pg_getnameinfo_all(&hba->addr, sizeof(struct sockaddr_storage),
+ 							buffer, sizeof(buffer),
+ 							NULL, 0,
+ 							NI_NUMERICHOST) == 0)
+ 	{
+ 		clean_ipv6_addr(hba->addr.ss_family, buffer);
+ 		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+ 	}
+ 	else
+ 		nulls[index] = true;
+ 
+ 	/* hostname */
+ 	index++;
+ 	if (hba->hostname)
+ 		values[index] = CStringGetTextDatum(hba->hostname);
+ 	else
+ 		nulls[index] = true;
+ 
+ 	/* method */
+  	index++;
+  	switch (hba->auth_method)
+  	{
+  		case uaReject:
+  			values[index] = CStringGetTextDatum("reject");
+  			break;
+  		case uaTrust:
+  			values[index] = CStringGetTextDatum("trust");
+  			break;
+  		case uaIdent:
+  			values[index] = CStringGetTextDatum("ident");
+  			break;
+  		case uaPassword:
+  			values[index] = CStringGetTextDatum("password");
+  			break;
+  		case uaMD5:
+  			values[index] = CStringGetTextDatum("md5");
+  			break;
+  		case uaGSS:
+  			values[index] = CStringGetTextDatum("gss");
+  			break;
+  		case uaSSPI:
+  			values[index] = CStringGetTextDatum("sspi");
+  			break;
+  		case uaPAM:
+  			values[index] = CStringGetTextDatum("pam");
+  			break;
+  		case uaLDAP:
+  			values[index] = CStringGetTextDatum("ldap");
+  			break;
+  		case uaCert:
+  			values[index] = CStringGetTextDatum("cert");
+  			break;
+  		case uaRADIUS:
+  			values[index] = CStringGetTextDatum("radius");
+  			break;
+  		case uaPeer:
+  			values[index] = CStringGetTextDatum("peer");
+  			break;
+  		default:
+  			elog(ERROR, "unexpected authentication method in parsed HBA entry");
+  			break;
+  	}
+ 
+ 	/* options */
+ 	index++;
+ 	memset(&result, 0, sizeof(JsonbInState));
+ 	result.res = pushJsonbValue(&result.parseState, WJB_BEGIN_OBJECT, NULL);
+ 
+ 	if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
+ 	{
+ 		if (hba->include_realm)
+ 		{
+ 			str = pstrdup("include_realm");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(BoolGetDatum(true), false, &result, BOOLOID, false);
+ 		}
+ 
+ 		if (hba->krb_realm)
+ 		{
+ 			str = pstrdup("krb_realm");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->krb_realm), false, &result, TEXTOID, false);
+ 		}
+ 	}
+ 
+ 	if (hba->usermap)
+ 	{
+ 		str = pstrdup("map");
+ 		len = strlen(str);
+ 
+ 		v.type = jbvString;
+ 
+ 		v.val.string.len = len;
+ 		v.val.string.val = str;
+ 
+ 		result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 		add_jsonb(CStringGetTextDatum(hba->usermap), false, &result, TEXTOID, false);
+ 	}
+ 
+ 	if (hba->auth_method == uaLDAP)
+ 	{
+ 		if (hba->ldapserver)
+ 		{
+ 			str = pstrdup("ldapserver");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->ldapserver), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->ldapport)
+ 		{
+ 			str = pstrdup("ldapport");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(Int32GetDatum(hba->ldapport), false, &result, INT4OID, false);
+ 		}
+ 
+ 		if (hba->ldaptls)
+ 		{
+ 			str = pstrdup("ldaptls");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(BoolGetDatum(true), false, &result, BOOLOID, false);
+ 		}
+ 
+ 		if (hba->ldapprefix)
+ 		{
+ 			str = pstrdup("ldapprefix");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->ldapprefix), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->ldapsuffix)
+ 		{
+ 			str = pstrdup("ldapsuffix");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->ldapsuffix), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->ldapbasedn)
+ 		{
+ 			str = pstrdup("ldapbasedn");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->ldapbasedn), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->ldapbinddn)
+ 		{
+ 			str = pstrdup("ldapbinddn");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->ldapbinddn), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->ldapbindpasswd)
+ 		{
+ 			str = pstrdup("ldapbindpasswd");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->ldapbindpasswd), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->ldapsearchattribute)
+ 		{
+ 			str = pstrdup("ldapsearchattribute");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->ldapsearchattribute), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->ldapscope)
+ 		{
+ 			str = pstrdup("ldapscope");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(Int32GetDatum(hba->ldapscope), false, &result, INT4OID, false);
+ 		}
+ 	}
+ 
+ 	if (hba->auth_method == uaRADIUS)
+ 	{
+ 		if (hba->radiusserver)
+ 		{
+ 			str = pstrdup("radiusserver");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->radiusserver), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->radiussecret)
+ 		{
+ 			str = pstrdup("radiussecret");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->radiussecret), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->radiusidentifier)
+ 		{
+ 			str = pstrdup("radiusidentifier");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(CStringGetTextDatum(hba->radiusidentifier), false, &result, TEXTOID, false);
+ 		}
+ 
+ 		if (hba->radiusport)
+ 		{
+ 			str = pstrdup("radiusport");
+ 			len = strlen(str);
+ 
+ 			v.type = jbvString;
+ 
+ 			v.val.string.len = len;
+ 			v.val.string.val = str;
+ 
+ 			result.res = pushJsonbValue(&result.parseState, WJB_KEY, &v);
+ 			add_jsonb(Int32GetDatum(hba->radiusport), false, &result, INT4OID, false);
+ 		}
+ 	}
+ 
+ 	result.res = pushJsonbValue(&result.parseState, WJB_END_OBJECT, NULL);
+ 	values[index] = PointerGetDatum(JsonbValueToJsonb(result.res));
+ 
+ 	/* mode */
+ 	index++;
+ 	if (hba_match_result)
+ 		values[index] = CStringGetTextDatum("matched");
+ 	else
+ 		values[index] = CStringGetTextDatum("skipped");
+ }
+ 
+ static bool
+ pg_hba_match(HbaLine *hba, char *database, char *user, struct sockaddr_storage *addr,
+ 			char *hostname, bool ssl_inuse, hba_lookup_args_mode args_mode)
+ {
+ 	Oid			roleid;
+ 
+ 	if (ssl_inuse)
+ 	{
+ #ifdef USE_SSL
+ 		if (EnableSSL && hba->conntype != ctHostSSL)
+ 		{
+ 			ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of non SSL connection type.",
+ 					hba->linenumber)));
+ 			return false;
+ 		}
+ 		else
+ 		{
+ 			ereport(ERROR,
+ 					(errcode(ERRCODE_CONFIG_FILE_ERROR),
+ 					 errmsg("hostssl requires SSL to be turned on"),
+ 					 errhint("Set ssl = on in postgresql.conf.")));
+ 			return false;
+ 		}
+ #else
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_CONFIG_FILE_ERROR),
+ 				 errmsg("hostssl is not supported by this build"),
+ 		  errhint("Compile with --with-openssl to use SSL connections.")));
+ 		return false;
+ #endif
+ 	}
+ 
+ 	/* Get the target role's OID.  Note we do not error out for bad role. */
+ 	roleid = get_role_oid(user, true);
+ 
+ 	if (!check_db(database, user, roleid, hba->databases))
+ 	{
+ 		ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of non matching database.",
+ 				hba->linenumber)));
+ 		return false;
+ 	}
+ 
+ 	if (!check_role(user, roleid, hba->roles))
+ 	{
+ 		ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of non matching role.",
+ 				hba->linenumber)));
+ 		return false;
+ 	}
+ 
+ 	if (args_mode != TWO_ARGS_MODE)
+ 	{
+ 		/* Check IP address */
+ 		switch (hba->ip_cmp_method)
+ 		{
+ 			case ipCmpMask:
+ 				if (hostname && hba->hostname)
+ 				{
+ 					if (!hostname_match(hostname, hba->hostname))
+ 					{
+ 						ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of non matching hostname.",
+ 								hba->linenumber)));
+ 						return false;
+ 					}
+ 				}
+ 				else
+ 				{
+ 					if (!check_ip((SockAddr *)addr,
+ 								  (struct sockaddr *) & hba->addr,
+ 								  (struct sockaddr *) & hba->mask))
+ 					{
+ 						ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of non matching IP.",
+ 								hba->linenumber)));
+ 						return false;
+ 					}
+ 				}
+ 				break;
+ 			case ipCmpAll:
+ 				break;
+ 			case ipCmpSameHost:
+ 			case ipCmpSameNet:
+ 				if (!check_same_host_or_net((SockAddr *)addr,
+ 											hba->ip_cmp_method))
+ 				{
+ 					ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of non matching SameHost/SameNet.",
+ 							hba->linenumber)));
+ 					return false;
+ 				}
+ 				break;
+ 			default: /* Not reachable case*/
+ 				break;
+ 		}
+ 	}
+ 
+ 	return true;
+ }
+ 
+ 
+ #define NUM_PG_HBA_CONF_ATTS   9
+ 
+ static void
+ pg_hba_lookup_internal(char *database, char *user, struct sockaddr_storage *addr,
+ 		char *hostname, bool ssl_inuse, hba_lookup_args_mode args_mode, ReturnSetInfo *rsi)
+ {
+ 	Tuplestorestate *tuple_store;
+ 	TupleDesc	tupdesc;
+ 	ListCell   *line;
+ 	MemoryContext old_cxt;
+ 
+ 	/*
+ 	* Create the tupledesc and tuplestore in the per_query context as
+ 	* required for SFRM_Materialize.
+ 	*/
+ 	old_cxt = MemoryContextSwitchTo(rsi->econtext->ecxt_per_query_memory);
+ 
+ 	tupdesc = CreateTemplateTupleDesc(NUM_PG_HBA_CONF_ATTS, false);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)1, "line_number",
+ 		INT4OID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)2, "type",
+ 		TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)3, "database",
+ 		JSONBOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)4, "user",
+ 		JSONBOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)5, "address",
+ 		INETOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)6, "hostname",
+ 		TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)7, "method",
+ 		TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)8, "options",
+ 		JSONBOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)9, "mode",
+ 			TEXTOID, -1, 0);
+ 	BlessTupleDesc(tupdesc);
+ 
+ 	tuple_store =
+ 		tuplestore_begin_heap(rsi->allowedModes & SFRM_Materialize_Random,
+ 		false, work_mem);
+ 
+ 	MemoryContextSwitchTo(old_cxt);
+ 
+ 	/*
+ 	* Loop through the list and deparse each entry as it comes, storing it in
+ 	* the tuplestore. Any temporary memory allocations here live only for the
+ 	* function call lifetime.
+ 	*/
+ 	foreach(line, parsed_hba_lines)
+ 	{
+ 		HbaLine    *hba = (HbaLine *)lfirst(line);
+ 		Datum		values[NUM_PG_HBA_CONF_ATTS];
+ 		bool		nulls[NUM_PG_HBA_CONF_ATTS];
+ 		HeapTuple	tuple;
+ 		bool hba_match_result;
+ 
+ 		MemSet(values, 0, sizeof(values));
+ 		MemSet(nulls, 0, sizeof(nulls));
+ 
+ 		CHECK_FOR_INTERRUPTS();
+ 
+ 		hba_match_result = pg_hba_match(hba, database, user, addr, hostname, ssl_inuse, args_mode);
+ 
+ 		/* Get the next parsed hba line values */
+ 		hba_getvalues_for_line(hba, values, nulls, hba_match_result);
+ 
+ 		/* build a tuple */
+ 		tuple = heap_form_tuple(tupdesc, values, nulls);
+ 		tuplestore_puttuple(tuple_store, tuple);
+ 	}
+ 
+ 	rsi->setDesc = tupdesc;
+ 	rsi->setResult = tuple_store;
+ 	return;
+ }
+ 
+ /*
+ * SQL-accessible SRF to return all the settings from the pg_hba.conf
+ * file.
+ */
+ Datum
+ pg_hba_lookup_2args(PG_FUNCTION_ARGS)
+ {
+ 	return pg_hba_lookup(fcinfo);
+ }
+ 
+ /*
+  * SQL-accessible SRF to return all the settings from the pg_hba.conf
+  * file.
+  */
+ Datum
+ pg_hba_lookup_3args(PG_FUNCTION_ARGS)
+ {
+ 	return pg_hba_lookup(fcinfo);
+ }
+ 
+ /*
+  * SQL-accessible SRF to return all the settings from the pg_hba.conf
+  * file. 
+  */
+ Datum
+ pg_hba_lookup(PG_FUNCTION_ARGS)
+ {
+ 	char	*user;
+ 	char	*database;
+ 	char	*address;
+ 	char    *hostname;
+ 	bool	ssl_inuse = false;
+ 	struct sockaddr_storage addr;
+ 	hba_lookup_args_mode args_mode = TWO_ARGS_MODE; /* Minimum number of arguments */
+ 
+ 	/*
+ 	* We must use the Materialize mode to be safe against HBA file reloads
+ 	* while the cursor is open. It's also more efficient than having to look
+ 	* up our current position in the parsed list every time.
+ 	*/
+ 	ReturnSetInfo *rsi = (ReturnSetInfo *)fcinfo->resultinfo;
+ 
+ 	if (!superuser())
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+ 				 (errmsg("only superuser can view pg_hba.conf settings"))));
+ 
+ 	if (!rsi || !IsA(rsi, ReturnSetInfo) ||
+ 		(rsi->allowedModes & SFRM_Materialize) == 0)
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+ 				errmsg("set-valued function called in context that "
+ 						"cannot accept a set")));
+ 
+ 	if (PG_ARGISNULL(0))
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+ 				(errmsg("database name is required to match pg_hba configuration entry"))));
+ 	else
+ 		database = TextDatumGetCString(PG_GETARG_DATUM(0));
+ 
+ 	if (PG_ARGISNULL(1))
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+ 				(errmsg("user name is required to match pg_hba configuration entry"))));
+ 	else
+ 		user = TextDatumGetCString(PG_GETARG_DATUM(1));
+ 
+ 	if (PG_NARGS() != 2)
+ 	{
+ 		struct addrinfo *gai_result;
+ 		struct addrinfo hints;
+ 		int ret;
+ 
+ 		args_mode = THREE_ARGS_MODE;
+ 		if (!PG_ARGISNULL(2))
+ 			address = TextDatumGetCString(PG_GETARG_DATUM(2));
+ 
+ 		/* Get the IP address either way */
+ 		hints.ai_flags = AI_NUMERICHOST;
+ 		hints.ai_family = AF_UNSPEC;
+ 		hints.ai_socktype = 0;
+ 		hints.ai_protocol = 0;
+ 		hints.ai_addrlen = 0;
+ 		hints.ai_canonname = NULL;
+ 		hints.ai_addr = NULL;
+ 		hints.ai_next = NULL;
+ 
+ 		ret = pg_getaddrinfo_all(address, NULL, &hints, &gai_result);
+ 		if (ret == 0 && gai_result)
+ 			memcpy(&addr, gai_result->ai_addr, gai_result->ai_addrlen);
+ 		else if (ret == EAI_NONAME)
+ 			hostname = pstrdup(address);
+ 		else
+ 		{
+ 			ereport(ERROR,
+ 					(errmsg("invalid IP address \"%s\": %s",
+ 							 address, gai_strerror(ret))));
+ 			if (gai_result)
+ 				pg_freeaddrinfo_all(hints.ai_family, gai_result);
+ 			return false;
+ 		}
+ 
+ 		pg_freeaddrinfo_all(hints.ai_family, gai_result);
+ 
+ 		if (PG_NARGS() != 3)
+ 		{
+ 			args_mode = FOUR_ARGS_MODE;
+ 			if (!PG_ARGISNULL(3))
+ 				ssl_inuse = DatumGetBool(PG_GETARG_DATUM(3));
+ 		}
+ 	}
+ 
+ 	if (load_hba_failure)
+ 		ereport(WARNING,
+ 		(errmsg("There was some failure in reloading pg_hba.conf file. "
+ 		"The pg_hba.conf settings data may contains stale information")));
+ 
+ 	rsi->returnMode = SFRM_Materialize;
+ 
+ 	pg_hba_lookup_internal(database, user, &addr, hostname, ssl_inuse, args_mode, rsi);
+ 
+ 	PG_RETURN_NULL();
+ }
+ 
+ 
*** a/src/backend/tcop/postgres.c
--- b/src/backend/tcop/postgres.c
***************
*** 4005,4010 **** PostgresMain(int argc, char *argv[],
--- 4005,4023 ----
  		{
  			got_SIGHUP = false;
  			ProcessConfigFile(PGC_SIGHUP);
+ 			
+ 			/* 
+ 			 * Reload authentication config files too to refresh 
+ 			 * pg_hba_conf view data.
+ 			 */
+ 			if (!load_hba())
+ 			{
+ 				ereport(DEBUG1,
+ 					(errmsg("Falure in reloading pg_hba.conf, pg_hba_conf view may show stale information")));
+ 				load_hba_failure = true;
+ 			}
+ 			
+ 			load_hba_failure = false;
  		}
  
  		/*
*** a/src/backend/utils/adt/jsonb.c
--- b/src/backend/utils/adt/jsonb.c
***************
*** 28,39 ****
  #include "utils/syscache.h"
  #include "utils/typcache.h"
  
- typedef struct JsonbInState
- {
- 	JsonbParseState *parseState;
- 	JsonbValue *res;
- } JsonbInState;
- 
  /* unlike with json categories, we need to treat json and jsonb differently */
  typedef enum					/* type categories for datum_to_jsonb */
  {
--- 28,33 ----
***************
*** 83,89 **** static void jsonb_categorize_type(Oid typoid,
  static void datum_to_jsonb(Datum val, bool is_null, JsonbInState *result,
  			   JsonbTypeCategory tcategory, Oid outfuncoid,
  			   bool key_scalar);
! static void add_jsonb(Datum val, bool is_null, JsonbInState *result,
  		  Oid val_type, bool key_scalar);
  static JsonbParseState *clone_parse_state(JsonbParseState *state);
  static char *JsonbToCStringWorker(StringInfo out, JsonbContainer *in, int estimated_len, bool indent);
--- 77,83 ----
  static void datum_to_jsonb(Datum val, bool is_null, JsonbInState *result,
  			   JsonbTypeCategory tcategory, Oid outfuncoid,
  			   bool key_scalar);
! void add_jsonb(Datum val, bool is_null, JsonbInState *result,
  		  Oid val_type, bool key_scalar);
  static JsonbParseState *clone_parse_state(JsonbParseState *state);
  static char *JsonbToCStringWorker(StringInfo out, JsonbContainer *in, int estimated_len, bool indent);
***************
*** 1113,1119 **** composite_to_jsonb(Datum composite, JsonbInState *result)
   * lookups only once.
   */
  
! static void
  add_jsonb(Datum val, bool is_null, JsonbInState *result,
  		  Oid val_type, bool key_scalar)
  {
--- 1107,1113 ----
   * lookups only once.
   */
  
! void
  add_jsonb(Datum val, bool is_null, JsonbInState *result,
  		  Oid val_type, bool key_scalar)
  {
*** a/src/include/catalog/pg_proc.h
--- b/src/include/catalog/pg_proc.h
***************
*** 3079,3084 **** DATA(insert OID = 2084 (  pg_show_all_settings	PGNSP PGUID 12 1 1000 0 0 f f f f
--- 3079,3090 ----
  DESCR("SHOW ALL as a function");
  DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
  DESCR("show config file settings");
+ DATA(insert OID = 3997 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f t t v u 2 0 2249 "25 25" "{25,25,23,25,3802,3802,869,25,25,3802,25}" "{i,i,o,o,o,o,o,o,o,o,o}" "{database,user,line_number,type,database,user,address,hostname,method,options,mode}" _null_ _null_ pg_hba_lookup_2args _null_ _null_ _null_));
+ DESCR("view client authentication settings");
+ DATA(insert OID = 3998 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f t t v u 3 0 2249 "25 25 25" "{25,25,25,23,25,3802,3802,869,25,25,3802,25}" "{i,i,i,o,o,o,o,o,o,o,o,o}" "{database,user,address,line_number,type,database,user,address,hostname,method,options,mode}" _null_ _null_ pg_hba_lookup_3args _null_ _null_ _null_));
+ DESCR("view client authentication settings");
+ DATA(insert OID = 3999 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f t t v u 4 0 2249 "25 25 25 16" "{25,25,25,16,23,25,3802,3802,869,25,25,3802,25}" "{i,i,i,i,o,o,o,o,o,o,o,o,o}" "{database,user,address,ssl_inuse,line_number,type,database,user,address,hostname,method,options,mode}" _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+ DESCR("view client authentication settings");
  DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
  DESCR("view system lock information");
  DATA(insert OID = 1065 (  pg_prepared_xact PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{28,25,1184,26,26}" "{o,o,o,o,o}" "{transaction,gid,prepared,ownerid,dbid}" _null_ _null_ pg_prepared_xact _null_ _null_ _null_ ));
*** a/src/include/libpq/hba.h
--- b/src/include/libpq/hba.h
***************
*** 96,101 **** typedef struct IdentLine
--- 96,103 ----
  /* kluge to avoid including libpq/libpq-be.h here */
  typedef struct Port hbaPort;
  
+ extern bool load_hba_failure;
+ 
  extern bool load_hba(void);
  extern bool load_ident(void);
  extern void hba_getauthmethod(hbaPort *port);
*** a/src/include/utils/builtins.h
--- b/src/include/utils/builtins.h
***************
*** 1123,1128 **** extern Datum set_config_by_name(PG_FUNCTION_ARGS);
--- 1123,1133 ----
  extern Datum show_all_settings(PG_FUNCTION_ARGS);
  extern Datum show_all_file_settings(PG_FUNCTION_ARGS);
  
+ /* hba.c */
+ extern Datum pg_hba_lookup_2args(PG_FUNCTION_ARGS);
+ extern Datum pg_hba_lookup_3args(PG_FUNCTION_ARGS);
+ extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
+ 
  /* rls.c */
  extern Datum row_security_active(PG_FUNCTION_ARGS);
  extern Datum row_security_active_name(PG_FUNCTION_ARGS);
*** a/src/include/utils/json.h
--- b/src/include/utils/json.h
***************
*** 43,49 **** extern Datum json_object(PG_FUNCTION_ARGS);
  extern Datum json_object_two_arg(PG_FUNCTION_ARGS);
  
  extern void escape_json(StringInfo buf, const char *str);
- 
  extern Datum json_typeof(PG_FUNCTION_ARGS);
  
  /* functions in jsonfuncs.c */
--- 43,48 ----
*** a/src/include/utils/jsonb.h
--- b/src/include/utils/jsonb.h
***************
*** 343,348 **** typedef struct JsonbIterator
--- 343,354 ----
  	struct JsonbIterator *parent;
  } JsonbIterator;
  
+ typedef struct JsonbInState
+ {
+ 	JsonbParseState *parseState;
+ 	JsonbValue *res;
+ } JsonbInState;
+ 
  /* I/O routines */
  extern Datum jsonb_in(PG_FUNCTION_ARGS);
  extern Datum jsonb_out(PG_FUNCTION_ARGS);
***************
*** 428,433 **** extern bool JsonbDeepContains(JsonbIterator **val,
--- 434,441 ----
  extern void JsonbHashScalarValue(const JsonbValue *scalarVal, uint32 *hash);
  
  /* jsonb.c support functions */
+ void add_jsonb(Datum val, bool is_null, JsonbInState *result,
+ 	Oid val_type, bool key_scalar);
  extern char *JsonbToCString(StringInfo out, JsonbContainer *in,
  			   int estimated_len);
  extern char *JsonbToCStringIndent(StringInfo out, JsonbContainer *in,
*** a/src/test/regress/expected/rules.out
--- b/src/test/regress/expected/rules.out
***************
*** 1327,1332 **** pg_group| SELECT pg_authid.rolname AS groname,
--- 1327,1344 ----
            WHERE (pg_auth_members.roleid = pg_authid.oid)) AS grolist
     FROM pg_authid
    WHERE (NOT pg_authid.rolcanlogin);
+ pg_hba_conf| SELECT a.line_number,
+     a.type,
+     a.keyword_databases,
+     a.databases,
+     a.keyword_users,
+     a.users,
+     a.address,
+     a.compare_method,
+     a.hostname,
+     a.method,
+     a.options
+    FROM pg_hba_conf() a(line_number, type, keyword_databases, databases, keyword_users, users, address, compare_method, hostname, method, options);
  pg_indexes| SELECT n.nspname AS schemaname,
      c.relname AS tablename,
      i.relname AS indexname,

*** a/src/backend/libpq/hba.c
--- b/src/backend/libpq/hba.c
***************
*** 1657,1681 **** check_hba(hbaPort *port)
--- 1657,1697 ----
  		if (hba->conntype == ctLocal)
  		{
  			if (!IS_AF_UNIX(port->raddr.addr.ss_family))
+ 			{
+ 				ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of host connection type.",
+ 				 					hba->linenumber)));
  				continue;
+ 			}
  		}
  		else
  		{
  			if (IS_AF_UNIX(port->raddr.addr.ss_family))
+ 			{
+ 				ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of local connection type.",
+ 				 					hba->linenumber)));
  				continue;
+ 			}
  
  			/* Check SSL state */
  			if (port->ssl_in_use)
  			{
  				/* Connection is SSL, match both "host" and "hostssl" */
  				if (hba->conntype == ctHostNoSSL)
+ 				{
+ 					ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of SSL connection.",
+ 					 					hba->linenumber)));
  					continue;
+ 				}
  			}
  			else
  			{
  				/* Connection is not SSL, match both "host" and "hostnossl" */
  				if (hba->conntype == ctHostSSL)
+ 				{
+ 					ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of not SSL connection.",
+ 					 					hba->linenumber)));
  					continue;
+ 				}
  			}
  
  			/* Check IP address */
***************
*** 1686,1699 **** check_hba(hbaPort *port)
--- 1702,1723 ----
  					{
  						if (!check_hostname(port,
  											hba->hostname))
+ 						{
+ 							ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of non matching hostname.",
+ 							 					hba->linenumber)));
  							continue;
+ 						}
  					}
  					else
  					{
  						if (!check_ip(&port->raddr,
  									  (struct sockaddr *) & hba->addr,
  									  (struct sockaddr *) & hba->mask))
+ 						{
+ 							ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of non matching IP.",
+ 							 					hba->linenumber)));
  							continue;
+ 						}
  					}
  					break;
  				case ipCmpAll:
***************
*** 1702,1708 **** check_hba(hbaPort *port)
--- 1726,1736 ----
  				case ipCmpSameNet:
  					if (!check_same_host_or_net(&port->raddr,
  												hba->ip_cmp_method))
+ 					{
+ 						ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of non matching samenet/samehost.",
+ 						 					hba->linenumber)));
  						continue;
+ 					}
  					break;
  				default:
  					/* shouldn't get here, but deem it no-match if so */
***************
*** 1713,1722 **** check_hba(hbaPort *port)
--- 1741,1758 ----
  		/* Check database and role */
  		if (!check_db(port->database_name, port->user_name, roleid,
  					  hba->databases))
+ 		{
+ 			ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of non matching database.",
+ 			 					hba->linenumber)));
  			continue;
+ 		}
  
  		if (!check_role(port->user_name, roleid, hba->roles))
+ 		{
+ 			ereport(NOTICE, (errmsg("Skipped %d pg_hba line, because of non matching role.",
+ 			 					hba->linenumber)));
  			continue;
+ 		}
  
  		/* Found a record that matched! */
  		port->hba = hba;

*** a/doc/src/sgml/func.sgml
--- b/doc/src/sgml/func.sgml
***************
*** 16576,16581 **** SELECT collation for ('foo' COLLATE "de_DE");
--- 16576,16594 ----
         <entry><type>text</type></entry>
         <entry>set parameter and return new value</entry>
        </row>
+ 	  <row>
+        <entry>
+         <indexterm>
+          <primary>pg_hba_lookup</primary>
+         </indexterm>
+         <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+ 							<parameter>user</> <type>text</>
+ 							[, <parameter>address</> <type>text</>]
+ 							[, <parameter>ssl_inuse</> <type>text</>)</function></literal>
+        </entry>
+        <entry><type>record</type></entry>
+        <entry>Returns all row entries of pg_hba.conf till matching entry is found</entry>
+       </row>
       </tbody>
      </tgroup>
     </table>
***************
*** 16633,16638 **** SELECT set_config('log_statement_stats', 'off', false);
--- 16646,16667 ----
  </programlisting>
     </para>
  
+    <para>
+     <function>pg_hba_lookup</function> returns a set of records
+ 	containing the line number, mode, type, database, user, address,
+ 	hostname, method, options and reason. Typical usages include:
+ <programlisting>
+ postgres=# select * from pg_hba_lookup('postgres','kommih', '::1');
+  line_number |  mode   | type  | database |  user   |  address  | hostname | method |      options       |     reason      
+ -------------+---------+-------+----------+---------+-----------+----------+--------+--------------------+-----------------
+           84 | skipped | local | ["all"]  | ["all"] |           |          | trust  | {}                 | non matching IP
+           86 | skipped | host  | ["all"]  | ["all"] | 127.0.0.1 |          | ident  | {"map": "omicron"} | non matching IP
+           88 | matched | host  | ["all"]  | ["all"] | ::1       |          | trust  | {}                 | 
+ (3 rows)
+ </programlisting>
+ 	Only super user can access this function to view the pg_hba entries.
+    </para>
+    
    </sect2>
  
    <sect2 id="functions-admin-signal">
*** a/src/backend/libpq/hba.c
--- b/src/backend/libpq/hba.c
***************
*** 25,39 ****
--- 25,45 ----
  #include <arpa/inet.h>
  #include <unistd.h>
  
+ #include "access/htup_details.h"
  #include "catalog/pg_collation.h"
+ #include "catalog/pg_type.h"
+ #include "funcapi.h"
  #include "libpq/ip.h"
  #include "libpq/libpq.h"
+ #include "miscadmin.h"
  #include "postmaster/postmaster.h"
  #include "regex/regex.h"
  #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "utils/acl.h"
+ #include "utils/builtins.h"
  #include "utils/guc.h"
+ #include "utils/jsonb.h"
  #include "utils/lsyscache.h"
  #include "utils/memutils.h"
  
***************
*** 52,57 ****
--- 58,65 ----
  #define MAX_TOKEN	256
  #define MAX_LINE	8192
  
+ #define MAX_LEN_OF_NON_MATCH_HBA_ENTRY_REASON 256
+ 
  /* callback data for check_network_callback */
  typedef struct check_network_data
  {
***************
*** 74,79 **** typedef struct HbaToken
--- 82,97 ----
  	bool		quoted;
  } HbaToken;
  
+ typedef enum hba_lookup_args_mode
+ {
+ 	TWO_ARGS_MODE=0,
+ 	THREE_ARGS_MODE,
+ 	FOUR_ARGS_MODE
+ }hba_lookup_args_mode;
+ 
+ /* Flag to indicate the failure of reloading pg_hba.conf file */
+ bool		load_hba_failure = false;
+ 
  /*
   * pre-parsed content of HBA config file: list of HbaLine structs.
   * parsed_hba_context is the memory context where it lives.
***************
*** 99,104 **** static List *tokenize_inc_file(List *tokens, const char *outer_filename,
--- 117,135 ----
  				  const char *inc_filename);
  static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
  				   int line_num);
+ static Datum getauthmethod(UserAuth	auth_method);
+ static void hba_add_jsonb_string_elem(JsonbParseState **pstate, char *string_elem);
+ static void hba_add_jsonb_string_key(JsonbParseState **pstate, char *string_key);
+ static void hba_add_jsonb_bool_value(JsonbParseState **pstate, bool bool_val);
+ static void hba_add_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val);
+ static void hba_add_jsonb_string_value(JsonbParseState **pstate, char *string_value);
+ static void hba_getvalues_for_line(HbaLine *hba, Datum *values, bool *nulls,
+ 			bool hba_match_result, char *reason);
+ static bool pg_hba_match(HbaLine *hba, char *user, char *database, struct sockaddr_storage *addr,
+ 		 				char *hostname, bool ssl_inuse, hba_lookup_args_mode args_mode,
+ 						char *reason);
+ static void pg_hba_lookup_internal(char	*database, char	*user, struct sockaddr_storage *addr,
+ 			char *hostname, bool ssl_inuse, hba_lookup_args_mode args_mode, ReturnSetInfo *rsi);
  
  /*
   * isblank() exists in the ISO C99 spec, but it's not very portable yet,
***************
*** 2233,2235 **** hba_getauthmethod(hbaPort *port)
--- 2264,2921 ----
  {
  	check_hba(port);
  }
+ 
+ /*
+  * Returns the Text Datum representation of authentication method
+  */
+ static Datum
+ getauthmethod(UserAuth auth_method)
+ {
+ 	Datum result;
+ 
+   	switch (auth_method)
+   	{
+   		case uaReject:
+   			result = CStringGetTextDatum("reject");
+   			break;
+   		case uaTrust:
+   			result = CStringGetTextDatum("trust");
+   			break;
+   		case uaIdent:
+   			result = CStringGetTextDatum("ident");
+   			break;
+   		case uaPassword:
+   			result = CStringGetTextDatum("password");
+   			break;
+   		case uaMD5:
+   			result = CStringGetTextDatum("md5");
+   			break;
+   		case uaGSS:
+   			result = CStringGetTextDatum("gss");
+   			break;
+   		case uaSSPI:
+   			result = CStringGetTextDatum("sspi");
+   			break;
+   		case uaPAM:
+   			result = CStringGetTextDatum("pam");
+   			break;
+   		case uaLDAP:
+   			result = CStringGetTextDatum("ldap");
+   			break;
+   		case uaCert:
+   			result = CStringGetTextDatum("cert");
+   			break;
+   		case uaRADIUS:
+   			result = CStringGetTextDatum("radius");
+   			break;
+   		case uaPeer:
+   			result = CStringGetTextDatum("peer");
+   			break;
+   		default:
+   			elog(ERROR, "unexpected authentication method in parsed HBA entry");
+   			break;
+   	}
+ 
+   	return result;
+ }
+ 
+ static void
+ hba_add_jsonb_string_elem(JsonbParseState **pstate, char *string_elem)
+ {
+ 	JsonbValue jb;
+ 
+ 	jb.type = jbvString;
+ 	jb.val.string.len = strlen(string_elem);
+ 	jb.val.string.val = pstrdup(string_elem);
+ 	pushJsonbValue(pstate, WJB_ELEM, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_string_key(JsonbParseState **pstate, char *string_key)
+ {
+ 	JsonbValue jb;
+ 
+ 	jb.type = jbvString;
+ 	jb.val.string.len = strlen(string_key);
+ 	jb.val.string.val = pstrdup(string_key);
+ 	pushJsonbValue(pstate, WJB_KEY, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_bool_value(JsonbParseState **pstate, bool bool_val)
+ {
+ 	JsonbValue jb;
+ 
+ 	jb.type = jbvBool;
+ 	jb.val.boolean = bool_val;
+ 	pushJsonbValue(pstate, WJB_VALUE, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val)
+ {
+ 	JsonbValue jb;
+ 	char outputstr[64];
+ 
+ 	sprintf(outputstr, "%d", int32_val);
+ 	jb.type = jbvNumeric;
+ 	jb.val.numeric = DatumGetNumeric(DirectFunctionCall3(numeric_in, CStringGetDatum(outputstr), 0, -1));
+ 	pushJsonbValue(pstate, WJB_VALUE, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_string_value(JsonbParseState **pstate, char *string_value)
+ {
+ 	JsonbValue jb;
+ 
+ 	jb.type = jbvString;
+ 	jb.val.string.len = strlen(string_value);
+ 	jb.val.string.val = pstrdup(string_value);
+ 	pushJsonbValue(pstate, WJB_VALUE, &jb);
+ }
+ 
+ /*
+  * Fill in suitable values to build a tuple representing the
+  * HbaLine provided
+  */
+ static void
+ hba_getvalues_for_line(HbaLine *hba, Datum *values, bool *nulls, bool hba_match_result,
+ 					   char *reason)
+ {
+ 	ListCell   *dbcell;
+ 	char		buffer[NI_MAXHOST];
+ 	int			index = 0;
+ 	JsonbParseState *parseState = NULL;
+ 	JsonbValue *result;
+ 
+ 	/* line_number */
+ 	values[index] = Int32GetDatum(hba->linenumber);
+ 
+ 	/* mode */
+ 	index++;
+ 	if (hba_match_result)
+ 		values[index] = CStringGetTextDatum("matched");
+ 	else
+ 		values[index] = CStringGetTextDatum("skipped");
+ 
+ 	/* type */
+ 	index++;
+  	switch (hba->conntype)
+  	{
+  		case ctLocal:
+  			values[index] = CStringGetTextDatum("local");
+  			break;
+  		case ctHost:
+  			values[index] = CStringGetTextDatum("host");
+  			break;
+  		case ctHostSSL:
+  			values[index] = CStringGetTextDatum("hostssl");
+  			break;
+  		case ctHostNoSSL:
+  			values[index] = CStringGetTextDatum("hostnossl");
+  			break;
+  		default:
+  			elog(ERROR, "unexpected connection type in parsed HBA entry");
+  			break;
+  	}
+ 
+ 	/* database */
+ 	index++;
+ 	result = pushJsonbValue(&parseState, WJB_BEGIN_ARRAY, NULL);
+ 
+ 	if (list_length(hba->databases) != 0)
+ 	{
+ 		HbaToken   *tok;
+ 
+ 		foreach(dbcell, hba->databases)
+ 		{
+ 			tok = lfirst(dbcell);
+ 			hba_add_jsonb_string_elem(&parseState, tok->string);
+ 		}
+ 	}
+ 
+ 	result = pushJsonbValue(&parseState, WJB_END_ARRAY, NULL);
+ 	values[index] = PointerGetDatum(JsonbValueToJsonb(result));
+ 
+ 	/* user */
+ 	index++;
+ 	result = pushJsonbValue(&parseState, WJB_BEGIN_ARRAY, NULL);
+ 
+ 	if (list_length(hba->roles) != 0)
+ 	{
+ 		HbaToken   *tok;
+ 
+ 		foreach(dbcell, hba->roles)
+ 		{
+ 			tok = lfirst(dbcell);
+ 			hba_add_jsonb_string_elem(&parseState, tok->string);
+ 		}
+ 	}
+ 
+ 	result = pushJsonbValue(&parseState, WJB_END_ARRAY, NULL);
+ 	values[index] = PointerGetDatum(JsonbValueToJsonb(result));
+ 
+ 	/* address */
+ 	index++;
+ 	if (pg_getnameinfo_all(&hba->addr, sizeof(struct sockaddr_storage),
+ 							buffer, sizeof(buffer),
+ 							NULL, 0,
+ 							NI_NUMERICHOST) == 0)
+ 	{
+ 		clean_ipv6_addr(hba->addr.ss_family, buffer);
+ 		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+ 	}
+ 	else
+ 		nulls[index] = true;
+ 
+ 	/* hostname */
+ 	index++;
+ 	if (hba->hostname)
+ 		values[index] = CStringGetTextDatum(hba->hostname);
+ 	else
+ 		nulls[index] = true;
+ 
+ 	/* method */
+  	index++;
+  	values[index]= getauthmethod(hba->auth_method);
+ 
+ 	/* options */
+ 	index++;
+ 	result = pushJsonbValue(&parseState, WJB_BEGIN_OBJECT, NULL);
+ 
+ 	if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
+ 	{
+ 		if (hba->include_realm)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "include_realm");
+ 			hba_add_jsonb_bool_value(&parseState, true);
+ 		}
+ 
+ 		if (hba->krb_realm)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "krb_realm");
+ 			hba_add_jsonb_string_value(&parseState, hba->krb_realm);
+ 		}
+ 	}
+ 
+ 	if (hba->usermap)
+ 	{
+ 		hba_add_jsonb_string_key(&parseState, "map");
+ 		hba_add_jsonb_string_value(&parseState, hba->usermap);
+ 	}
+ 
+ 	if (hba->clientcert)
+ 	{
+ 		hba_add_jsonb_string_key(&parseState, "clientcert");
+ 		hba_add_jsonb_bool_value(&parseState, true);
+ 	}
+ 
+ 	if (hba->pamservice)
+ 	{
+ 		hba_add_jsonb_string_key(&parseState, "pamservice");
+ 		hba_add_jsonb_string_value(&parseState, hba->pamservice);
+ 	}
+ 
+ 	if (hba->auth_method == uaLDAP)
+ 	{
+ 		if (hba->ldapserver)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapserver");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapserver);
+ 		}
+ 
+ 		if (hba->ldapport)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapport");
+ 			hba_add_jsonb_int32_value(&parseState, hba->ldapport);
+ 		}
+ 
+ 		if (hba->ldaptls)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldaptls");
+ 			hba_add_jsonb_bool_value(&parseState, true);
+ 		}
+ 
+ 		if (hba->ldapprefix)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapprefix");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapprefix);
+ 		}
+ 
+ 		if (hba->ldapsuffix)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapsuffix");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapsuffix);
+ 		}
+ 
+ 		if (hba->ldapbasedn)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapbasedn");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapbasedn);
+ 		}
+ 
+ 		if (hba->ldapbinddn)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapbinddn");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapbinddn);
+ 		}
+ 
+ 		if (hba->ldapbindpasswd)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapbindpasswd");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapbindpasswd);
+ 		}
+ 
+ 		if (hba->ldapsearchattribute)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapsearchattribute");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapsearchattribute);
+ 		}
+ 
+ 		if (hba->ldapscope)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapscope");
+ 			hba_add_jsonb_int32_value(&parseState, hba->ldapscope);
+ 		}
+ 	}
+ 
+ 	if (hba->auth_method == uaRADIUS)
+ 	{
+ 		if (hba->radiusserver)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiusserver");
+ 			hba_add_jsonb_string_value(&parseState, hba->radiusserver);
+ 		}
+ 
+ 		if (hba->radiussecret)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiussecret");
+ 			hba_add_jsonb_string_value(&parseState, hba->radiussecret);
+ 		}
+ 
+ 		if (hba->radiusidentifier)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiusidentifier");
+ 			hba_add_jsonb_string_value(&parseState, hba->radiusidentifier);
+ 		}
+ 
+ 		if (hba->radiusport)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiusport");
+ 			hba_add_jsonb_int32_value(&parseState, hba->radiusport);
+ 		}
+ 	}
+ 
+ 	result = pushJsonbValue(&parseState, WJB_END_OBJECT, NULL);
+ 	values[index] = PointerGetDatum(JsonbValueToJsonb(result));
+ 
+ 	/* reason */
+ 	index++;
+ 	if (!hba_match_result)
+ 		values[index] = CStringGetTextDatum(reason);
+ 	else
+ 		nulls[index] = true;
+ }
+ 
+ static bool
+ pg_hba_match(HbaLine *hba, char *database, char *user, struct sockaddr_storage *addr,
+ 			char *hostname, bool ssl_inuse, hba_lookup_args_mode args_mode, char *reason)
+ {
+ 	Oid			roleid;
+ 
+ 	if (ssl_inuse)
+ 	{
+ #ifdef USE_SSL
+ 		if (EnableSSL && hba->conntype != ctHostSSL)
+ 		{
+ 			strcpy(reason, "non SSL connection type");
+ 			return false;
+ 		}
+ 		else
+ 		{
+ 			ereport(ERROR,
+ 					(errcode(ERRCODE_CONFIG_FILE_ERROR),
+ 					 errmsg("hostssl requires SSL to be turned on"),
+ 					 errhint("Set ssl = on in postgresql.conf.")));
+ 			return false;
+ 		}
+ #else
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_CONFIG_FILE_ERROR),
+ 				 errmsg("hostssl is not supported by this build"),
+ 		  errhint("Compile with --with-openssl to use SSL connections.")));
+ 		return false;
+ #endif
+ 	}
+ 
+ 	/* Get the target role's OID.  Note we do not error out for bad role. */
+ 	roleid = get_role_oid(user, true);
+ 
+ 	if (!check_db(database, user, roleid, hba->databases))
+ 	{
+ 		strcpy(reason, "non matching database");
+ 		return false;
+ 	}
+ 
+ 	if (!check_role(user, roleid, hba->roles))
+ 	{
+ 		strcpy(reason, "non matching role");
+ 		return false;
+ 	}
+ 
+ 	if (args_mode != TWO_ARGS_MODE)
+ 	{
+ 		/* Check IP address */
+ 		switch (hba->ip_cmp_method)
+ 		{
+ 			case ipCmpMask:
+ 				if (hostname && hba->hostname)
+ 				{
+ 					if (!hostname_match(hostname, hba->hostname))
+ 					{
+ 						strcpy(reason, "non matching hostname");
+ 						return false;
+ 					}
+ 				}
+ 				else
+ 				{
+ 					if (!check_ip((SockAddr *)addr,
+ 								  (struct sockaddr *) & hba->addr,
+ 								  (struct sockaddr *) & hba->mask))
+ 					{
+ 						strcpy(reason, "non matching IP");
+ 						return false;
+ 					}
+ 				}
+ 				break;
+ 			case ipCmpAll:
+ 				break;
+ 			case ipCmpSameHost:
+ 			case ipCmpSameNet:
+ 				if (!check_same_host_or_net((SockAddr *)addr,
+ 											hba->ip_cmp_method))
+ 				{
+ 					strcpy(reason, "non matching SameHost/SameNet");
+ 					return false;
+ 				}
+ 				break;
+ 			default: /* Not reachable case*/
+ 				break;
+ 		}
+ 	}
+ 
+ 	return true;
+ }
+ 
+ 
+ #define NUM_PG_HBA_CONF_ATTS   10
+ 
+ static void
+ pg_hba_lookup_internal(char *database, char *user, struct sockaddr_storage *addr,
+ 		char *hostname, bool ssl_inuse, hba_lookup_args_mode args_mode, ReturnSetInfo *rsi)
+ {
+ 	Tuplestorestate *tuple_store;
+ 	TupleDesc	tupdesc;
+ 	ListCell   *line;
+ 	MemoryContext old_cxt;
+ 
+ 	/*
+ 	* Create the tupledesc and tuplestore in the per_query context as
+ 	* required for SFRM_Materialize.
+ 	*/
+ 	old_cxt = MemoryContextSwitchTo(rsi->econtext->ecxt_per_query_memory);
+ 
+ 	tupdesc = CreateTemplateTupleDesc(NUM_PG_HBA_CONF_ATTS, false);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)1, "line_number",
+ 		INT4OID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)2, "mode",
+ 		TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)3, "type",
+ 		TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)4, "database",
+ 		JSONBOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)5, "user",
+ 		JSONBOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)6, "address",
+ 		INETOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)7, "hostname",
+ 		TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)8, "method",
+ 		TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)9, "options",
+ 		JSONBOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber)10, "reason",
+ 		TEXTOID, -1, 0);
+ 	BlessTupleDesc(tupdesc);
+ 
+ 	tuple_store =
+ 		tuplestore_begin_heap(rsi->allowedModes & SFRM_Materialize_Random,
+ 		false, work_mem);
+ 
+ 	MemoryContextSwitchTo(old_cxt);
+ 
+ 	/*
+ 	* Loop through the list and deparse each entry as it comes, storing it in
+ 	* the tuplestore. Any temporary memory allocations here live only for the
+ 	* function call lifetime.
+ 	*/
+ 	foreach(line, parsed_hba_lines)
+ 	{
+ 		HbaLine    *hba = (HbaLine *)lfirst(line);
+ 		Datum		values[NUM_PG_HBA_CONF_ATTS];
+ 		bool		nulls[NUM_PG_HBA_CONF_ATTS];
+ 		HeapTuple	tuple;
+ 		bool hba_match_result;
+ 		char reason[MAX_LEN_OF_NON_MATCH_HBA_ENTRY_REASON];
+ 
+ 		memset(values, 0, sizeof(values));
+ 		memset(nulls, 0, sizeof(nulls));
+ 
+ 		CHECK_FOR_INTERRUPTS();
+ 
+ 		hba_match_result = pg_hba_match(hba, database, user, addr, hostname,
+ 										ssl_inuse, args_mode, reason);
+ 
+ 		/* Get the next parsed hba line values */
+ 		hba_getvalues_for_line(hba, values, nulls, hba_match_result, reason);
+ 
+ 		/* build a tuple */
+ 		tuple = heap_form_tuple(tupdesc, values, nulls);
+ 		tuplestore_puttuple(tuple_store, tuple);
+ 
+ 		/* Stop the loop processing, if matching entry is found */
+ 		if (hba_match_result)
+ 			break;
+ 	}
+ 
+ 	rsi->setDesc = tupdesc;
+ 	rsi->setResult = tuple_store;
+ 	return;
+ }
+ 
+ /*
+ * SQL-accessible SRF to return all the settings from the pg_hba.conf
+ * file.
+ */
+ Datum
+ pg_hba_lookup_2args(PG_FUNCTION_ARGS)
+ {
+ 	return pg_hba_lookup(fcinfo);
+ }
+ 
+ /*
+  * SQL-accessible SRF to return all the settings from the pg_hba.conf
+  * file.
+  */
+ Datum
+ pg_hba_lookup_3args(PG_FUNCTION_ARGS)
+ {
+ 	return pg_hba_lookup(fcinfo);
+ }
+ 
+ /*
+  * SQL-accessible SRF to return all the settings from the pg_hba.conf
+  * file. 
+  */
+ Datum
+ pg_hba_lookup(PG_FUNCTION_ARGS)
+ {
+ 	char	*user;
+ 	char	*database;
+ 	char	*address;
+ 	char    *hostname;
+ 	bool	ssl_inuse = false;
+ 	struct sockaddr_storage addr;
+ 	hba_lookup_args_mode args_mode = TWO_ARGS_MODE; /* Minimum number of arguments */
+ 
+ 	/*
+ 	* We must use the Materialize mode to be safe against HBA file reloads
+ 	* while the cursor is open. It's also more efficient than having to look
+ 	* up our current position in the parsed list every time.
+ 	*/
+ 	ReturnSetInfo *rsi = (ReturnSetInfo *)fcinfo->resultinfo;
+ 
+ 	if (!superuser())
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+ 				 (errmsg("only superuser can view pg_hba.conf settings"))));
+ 
+ 	if (!rsi || !IsA(rsi, ReturnSetInfo) ||
+ 		(rsi->allowedModes & SFRM_Materialize) == 0)
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+ 				errmsg("set-valued function called in context that "
+ 						"cannot accept a set")));
+ 
+ 	if (PG_ARGISNULL(0))
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+ 				(errmsg("database name is required to match pg_hba configuration entry"))));
+ 	else
+ 		database = TextDatumGetCString(PG_GETARG_DATUM(0));
+ 
+ 	if (PG_ARGISNULL(1))
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+ 				(errmsg("user name is required to match pg_hba configuration entry"))));
+ 	else
+ 		user = TextDatumGetCString(PG_GETARG_DATUM(1));
+ 
+ 	if (PG_NARGS() != 2)
+ 	{
+ 		struct addrinfo *gai_result;
+ 		struct addrinfo hints;
+ 		int ret;
+ 
+ 		args_mode = THREE_ARGS_MODE;
+ 		if (!PG_ARGISNULL(2))
+ 			address = TextDatumGetCString(PG_GETARG_DATUM(2));
+ 
+ 		/* Get the IP address either way */
+ 		hints.ai_flags = AI_NUMERICHOST;
+ 		hints.ai_family = AF_UNSPEC;
+ 		hints.ai_socktype = 0;
+ 		hints.ai_protocol = 0;
+ 		hints.ai_addrlen = 0;
+ 		hints.ai_canonname = NULL;
+ 		hints.ai_addr = NULL;
+ 		hints.ai_next = NULL;
+ 
+ 		ret = pg_getaddrinfo_all(address, NULL, &hints, &gai_result);
+ 		if (ret == 0 && gai_result)
+ 			memcpy(&addr, gai_result->ai_addr, gai_result->ai_addrlen);
+ 		else if (ret == EAI_NONAME)
+ 			hostname = pstrdup(address);
+ 		else
+ 		{
+ 			ereport(ERROR,
+ 					(errmsg("invalid IP address \"%s\": %s",
+ 							 address, gai_strerror(ret))));
+ 			if (gai_result)
+ 				pg_freeaddrinfo_all(hints.ai_family, gai_result);
+ 			return false;
+ 		}
+ 
+ 		pg_freeaddrinfo_all(hints.ai_family, gai_result);
+ 
+ 		if (PG_NARGS() != 3)
+ 		{
+ 			args_mode = FOUR_ARGS_MODE;
+ 			if (!PG_ARGISNULL(3))
+ 				ssl_inuse = DatumGetBool(PG_GETARG_DATUM(3));
+ 		}
+ 	}
+ 
+ 	if (load_hba_failure)
+ 		ereport(WARNING,
+ 		(errmsg("There was some failure in reloading pg_hba.conf file. "
+ 		"The pg_hba.conf settings data may contains stale information")));
+ 
+ 	rsi->returnMode = SFRM_Materialize;
+ 
+ 	pg_hba_lookup_internal(database, user, &addr, hostname, ssl_inuse, args_mode, rsi);
+ 
+ 	PG_RETURN_NULL();
+ }
+ 
+ 
*** a/src/backend/tcop/postgres.c
--- b/src/backend/tcop/postgres.c
***************
*** 4005,4010 **** PostgresMain(int argc, char *argv[],
--- 4005,4023 ----
  		{
  			got_SIGHUP = false;
  			ProcessConfigFile(PGC_SIGHUP);
+ 			
+ 			/* 
+ 			 * Reload authentication config files too to refresh 
+ 			 * pg_hba_conf view data.
+ 			 */
+ 			if (!load_hba())
+ 			{
+ 				ereport(DEBUG1,
+ 					(errmsg("Falure in reloading pg_hba.conf, pg_hba_conf view may show stale information")));
+ 				load_hba_failure = true;
+ 			}
+ 			
+ 			load_hba_failure = false;
  		}
  
  		/*
*** a/src/include/catalog/pg_proc.h
--- b/src/include/catalog/pg_proc.h
***************
*** 3079,3084 **** DATA(insert OID = 2084 (  pg_show_all_settings	PGNSP PGUID 12 1 1000 0 0 f f f f
--- 3079,3090 ----
  DESCR("SHOW ALL as a function");
  DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
  DESCR("show config file settings");
+ DATA(insert OID = 3997 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f t t v u 2 0 2249 "25 25" "{25,25,23,25,25,3802,3802,869,25,25,3802,25}" "{i,i,o,o,o,o,o,o,o,o,o,o}" "{database,user,line_number,mode,type,database,user,address,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup_2args _null_ _null_ _null_));
+ DESCR("view client authentication settings");
+ DATA(insert OID = 3998 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f t t v u 3 0 2249 "25 25 25" "{25,25,25,23,25,25,3802,3802,869,25,25,3802,25}" "{i,i,i,o,o,o,o,o,o,o,o,o,o}" "{database,user,address,line_number,mode,type,database,user,address,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup_3args _null_ _null_ _null_));
+ DESCR("view client authentication settings");
+ DATA(insert OID = 3999 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f t t v u 4 0 2249 "25 25 25 16" "{25,25,25,16,23,25,25,3802,3802,869,25,25,3802,25}" "{i,i,i,i,o,o,o,o,o,o,o,o,o,o}" "{database,user,address,ssl_inuse,line_number,mode,type,database,user,address,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+ DESCR("view client authentication settings");
  DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
  DESCR("view system lock information");
  DATA(insert OID = 1065 (  pg_prepared_xact PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{28,25,1184,26,26}" "{o,o,o,o,o}" "{transaction,gid,prepared,ownerid,dbid}" _null_ _null_ pg_prepared_xact _null_ _null_ _null_ ));
*** a/src/include/libpq/hba.h
--- b/src/include/libpq/hba.h
***************
*** 96,101 **** typedef struct IdentLine
--- 96,103 ----
  /* kluge to avoid including libpq/libpq-be.h here */
  typedef struct Port hbaPort;
  
+ extern bool load_hba_failure;
+ 
  extern bool load_hba(void);
  extern bool load_ident(void);
  extern void hba_getauthmethod(hbaPort *port);
*** a/src/include/utils/builtins.h
--- b/src/include/utils/builtins.h
***************
*** 1123,1128 **** extern Datum set_config_by_name(PG_FUNCTION_ARGS);
--- 1123,1133 ----
  extern Datum show_all_settings(PG_FUNCTION_ARGS);
  extern Datum show_all_file_settings(PG_FUNCTION_ARGS);
  
+ /* hba.c */
+ extern Datum pg_hba_lookup_2args(PG_FUNCTION_ARGS);
+ extern Datum pg_hba_lookup_3args(PG_FUNCTION_ARGS);
+ extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
+ 
  /* rls.c */
  extern Datum row_security_active(PG_FUNCTION_ARGS);
  extern Datum row_security_active_name(PG_FUNCTION_ARGS);

*** a/doc/src/sgml/func.sgml
--- b/doc/src/sgml/func.sgml
***************
*** 16576,16581 **** SELECT collation for ('foo' COLLATE "de_DE");
--- 16576,16594 ----
         <entry><type>text</type></entry>
         <entry>set parameter and return new value</entry>
        </row>
+ 	  <row>
+        <entry>
+         <indexterm>
+          <primary>pg_hba_lookup</primary>
+         </indexterm>
+         <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+ 							<parameter>user</> <type>text</>
+ 							[, <parameter>address</> <type>text</>]
+ 							[, <parameter>ssl_inuse</> <type>text</>)</function></literal>
+        </entry>
+        <entry><type>record</type></entry>
+        <entry>Returns all row entries of pg_hba.conf till matching entry is found</entry>
+       </row>
       </tbody>
      </tgroup>
     </table>
***************
*** 16633,16638 **** SELECT set_config('log_statement_stats', 'off', false);
--- 16646,16667 ----
  </programlisting>
     </para>
  
+    <para>
+     <function>pg_hba_lookup</function> returns a set of records
+ 	containing the line number, mode, type, database, user, address,
+ 	hostname, method, options and reason. Typical usages include:
+ <programlisting>
+ postgres=# select * from pg_hba_lookup('postgres','kommih', '::1');
+  line_number |  mode   | type  | database |  user   |  address  | hostname | method |      options       |     reason      
+ -------------+---------+-------+----------+---------+-----------+----------+--------+--------------------+-----------------
+           84 | skipped | local | ["all"]  | ["all"] |           |          | trust  | {}                 | non matching IP
+           86 | skipped | host  | ["all"]  | ["all"] | 127.0.0.1 |          | ident  | {"map": "omicron"} | non matching IP
+           88 | matched | host  | ["all"]  | ["all"] | ::1       |          | trust  | {}                 | 
+ (3 rows)
+ </programlisting>
+ 	Only super user can access this function to view the pg_hba entries.
+    </para>
+    
    </sect2>
  
    <sect2 id="functions-admin-signal">
*** a/src/backend/libpq/hba.c
--- b/src/backend/libpq/hba.c
***************
*** 25,39 ****
--- 25,45 ----
  #include <arpa/inet.h>
  #include <unistd.h>
  
+ #include "access/htup_details.h"
  #include "catalog/pg_collation.h"
+ #include "catalog/pg_type.h"
+ #include "funcapi.h"
  #include "libpq/ip.h"
  #include "libpq/libpq.h"
+ #include "miscadmin.h"
  #include "postmaster/postmaster.h"
  #include "regex/regex.h"
  #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "utils/acl.h"
+ #include "utils/builtins.h"
  #include "utils/guc.h"
+ #include "utils/jsonb.h"
  #include "utils/lsyscache.h"
  #include "utils/memutils.h"
  
***************
*** 52,57 ****
--- 58,65 ----
  #define MAX_TOKEN	256
  #define MAX_LINE	8192
  
+ #define MAX_LEN_OF_NON_MATCH_HBA_ENTRY_REASON 256
+ 
  /* callback data for check_network_callback */
  typedef struct check_network_data
  {
***************
*** 74,79 **** typedef struct HbaToken
--- 82,97 ----
  	bool		quoted;
  } HbaToken;
  
+ typedef enum hba_lookup_args_mode
+ {
+ 	TWO_ARGS_MODE = 0,
+ 	THREE_ARGS_MODE,
+ 	FOUR_ARGS_MODE
+ }	hba_lookup_args_mode;
+ 
+ /* Flag to indicate the failure of reloading pg_hba.conf file */
+ bool		load_hba_failure = false;
+ 
  /*
   * pre-parsed content of HBA config file: list of HbaLine structs.
   * parsed_hba_context is the memory context where it lives.
***************
*** 99,104 **** static List *tokenize_inc_file(List *tokens, const char *outer_filename,
--- 117,135 ----
  				  const char *inc_filename);
  static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
  				   int line_num);
+ static Datum getauthmethod(UserAuth auth_method);
+ static void hba_add_jsonb_string_elem(JsonbParseState **pstate, char *string_elem);
+ static void hba_add_jsonb_string_key(JsonbParseState **pstate, char *string_key);
+ static void hba_add_jsonb_bool_value(JsonbParseState **pstate, bool bool_val);
+ static void hba_add_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val);
+ static void hba_add_jsonb_string_value(JsonbParseState **pstate, char *string_value);
+ static void hba_getvalues_for_line(HbaLine *hba, Datum *values, bool *nulls,
+ 					   bool hba_match_result, char *reason);
+ static bool pg_hba_match(HbaLine *hba, char *user, char *database, struct sockaddr_storage * addr,
+ 			 char *hostname, bool ssl_inuse, hba_lookup_args_mode args_mode,
+ 			 char *reason);
+ static void pg_hba_lookup_internal(char *database, char *user, struct sockaddr_storage * addr,
+ 					   char *hostname, bool ssl_inuse, hba_lookup_args_mode args_mode, ReturnSetInfo *rsi);
  
  /*
   * isblank() exists in the ISO C99 spec, but it's not very portable yet,
***************
*** 2233,2235 **** hba_getauthmethod(hbaPort *port)
--- 2264,2922 ----
  {
  	check_hba(port);
  }
+ 
+ /*
+  * Returns the Text Datum representation of authentication method
+  */
+ static Datum
+ getauthmethod(UserAuth auth_method)
+ {
+ 	Datum		result;
+ 
+ 	switch (auth_method)
+ 	{
+ 		case uaReject:
+ 			result = CStringGetTextDatum("reject");
+ 			break;
+ 		case uaTrust:
+ 			result = CStringGetTextDatum("trust");
+ 			break;
+ 		case uaIdent:
+ 			result = CStringGetTextDatum("ident");
+ 			break;
+ 		case uaPassword:
+ 			result = CStringGetTextDatum("password");
+ 			break;
+ 		case uaMD5:
+ 			result = CStringGetTextDatum("md5");
+ 			break;
+ 		case uaGSS:
+ 			result = CStringGetTextDatum("gss");
+ 			break;
+ 		case uaSSPI:
+ 			result = CStringGetTextDatum("sspi");
+ 			break;
+ 		case uaPAM:
+ 			result = CStringGetTextDatum("pam");
+ 			break;
+ 		case uaLDAP:
+ 			result = CStringGetTextDatum("ldap");
+ 			break;
+ 		case uaCert:
+ 			result = CStringGetTextDatum("cert");
+ 			break;
+ 		case uaRADIUS:
+ 			result = CStringGetTextDatum("radius");
+ 			break;
+ 		case uaPeer:
+ 			result = CStringGetTextDatum("peer");
+ 			break;
+ 		default:
+ 			elog(ERROR, "unexpected authentication method in parsed HBA entry");
+ 			break;
+ 	}
+ 
+ 	return result;
+ }
+ 
+ static void
+ hba_add_jsonb_string_elem(JsonbParseState **pstate, char *string_elem)
+ {
+ 	JsonbValue	jb;
+ 
+ 	jb.type = jbvString;
+ 	jb.val.string.len = strlen(string_elem);
+ 	jb.val.string.val = pstrdup(string_elem);
+ 	pushJsonbValue(pstate, WJB_ELEM, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_string_key(JsonbParseState **pstate, char *string_key)
+ {
+ 	JsonbValue	jb;
+ 
+ 	jb.type = jbvString;
+ 	jb.val.string.len = strlen(string_key);
+ 	jb.val.string.val = pstrdup(string_key);
+ 	pushJsonbValue(pstate, WJB_KEY, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_bool_value(JsonbParseState **pstate, bool bool_val)
+ {
+ 	JsonbValue	jb;
+ 
+ 	jb.type = jbvBool;
+ 	jb.val.boolean = bool_val;
+ 
+ 	pushJsonbValue(pstate, WJB_VALUE, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val)
+ {
+ 	JsonbValue	jb;
+ 	char		outputstr[64];
+ 
+ 	sprintf(outputstr, "%d", int32_val);
+ 	jb.type = jbvNumeric;
+ 	jb.val.numeric = DatumGetNumeric(DirectFunctionCall3(numeric_in, CStringGetDatum(outputstr), 0, -1));
+ 
+ 	pushJsonbValue(pstate, WJB_VALUE, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_string_value(JsonbParseState **pstate, char *string_value)
+ {
+ 	JsonbValue	jb;
+ 
+ 	jb.type = jbvString;
+ 	jb.val.string.len = strlen(string_value);
+ 	jb.val.string.val = pstrdup(string_value);
+ 	pushJsonbValue(pstate, WJB_VALUE, &jb);
+ }
+ 
+ /*
+  * Fill in suitable values to build a tuple representing the
+  * HbaLine provided
+  */
+ static void
+ hba_getvalues_for_line(HbaLine *hba, Datum *values, bool *nulls, bool hba_match_result,
+ 					   char *reason)
+ {
+ 	ListCell   *dbcell;
+ 	char		buffer[NI_MAXHOST];
+ 	int			index = 0;
+ 	JsonbParseState *parseState = NULL;
+ 	JsonbValue *result;
+ 
+ 	/* line_number */
+ 	values[index] = Int32GetDatum(hba->linenumber);
+ 
+ 	/* mode */
+ 	index++;
+ 	if (hba_match_result)
+ 		values[index] = CStringGetTextDatum("matched");
+ 	else
+ 		values[index] = CStringGetTextDatum("skipped");
+ 
+ 	/* type */
+ 	index++;
+ 	switch (hba->conntype)
+ 	{
+ 		case ctLocal:
+ 			values[index] = CStringGetTextDatum("local");
+ 			break;
+ 		case ctHost:
+ 			values[index] = CStringGetTextDatum("host");
+ 			break;
+ 		case ctHostSSL:
+ 			values[index] = CStringGetTextDatum("hostssl");
+ 			break;
+ 		case ctHostNoSSL:
+ 			values[index] = CStringGetTextDatum("hostnossl");
+ 			break;
+ 		default:
+ 			elog(ERROR, "unexpected connection type in parsed HBA entry");
+ 			break;
+ 	}
+ 
+ 	/* database */
+ 	index++;
+ 	result = pushJsonbValue(&parseState, WJB_BEGIN_ARRAY, NULL);
+ 
+ 	if (list_length(hba->databases) != 0)
+ 	{
+ 		HbaToken   *tok;
+ 
+ 		foreach(dbcell, hba->databases)
+ 		{
+ 			tok = lfirst(dbcell);
+ 			hba_add_jsonb_string_elem(&parseState, tok->string);
+ 		}
+ 	}
+ 
+ 	result = pushJsonbValue(&parseState, WJB_END_ARRAY, NULL);
+ 	values[index] = PointerGetDatum(JsonbValueToJsonb(result));
+ 
+ 	/* user */
+ 	index++;
+ 	result = pushJsonbValue(&parseState, WJB_BEGIN_ARRAY, NULL);
+ 
+ 	if (list_length(hba->roles) != 0)
+ 	{
+ 		HbaToken   *tok;
+ 
+ 		foreach(dbcell, hba->roles)
+ 		{
+ 			tok = lfirst(dbcell);
+ 			hba_add_jsonb_string_elem(&parseState, tok->string);
+ 		}
+ 	}
+ 
+ 	result = pushJsonbValue(&parseState, WJB_END_ARRAY, NULL);
+ 	values[index] = PointerGetDatum(JsonbValueToJsonb(result));
+ 
+ 	/* address */
+ 	index++;
+ 	if (pg_getnameinfo_all(&hba->addr, sizeof(struct sockaddr_storage),
+ 						   buffer, sizeof(buffer),
+ 						   NULL, 0,
+ 						   NI_NUMERICHOST) == 0)
+ 	{
+ 		clean_ipv6_addr(hba->addr.ss_family, buffer);
+ 		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+ 	}
+ 	else
+ 		nulls[index] = true;
+ 
+ 	/* hostname */
+ 	index++;
+ 	if (hba->hostname)
+ 		values[index] = CStringGetTextDatum(hba->hostname);
+ 	else
+ 		nulls[index] = true;
+ 
+ 	/* method */
+ 	index++;
+ 	values[index] = getauthmethod(hba->auth_method);
+ 
+ 	/* options */
+ 	index++;
+ 	result = pushJsonbValue(&parseState, WJB_BEGIN_OBJECT, NULL);
+ 
+ 	if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
+ 	{
+ 		if (hba->include_realm)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "include_realm");
+ 			hba_add_jsonb_bool_value(&parseState, true);
+ 		}
+ 
+ 		if (hba->krb_realm)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "krb_realm");
+ 			hba_add_jsonb_string_value(&parseState, hba->krb_realm);
+ 		}
+ 	}
+ 
+ 	if (hba->usermap)
+ 	{
+ 		hba_add_jsonb_string_key(&parseState, "map");
+ 		hba_add_jsonb_string_value(&parseState, hba->usermap);
+ 	}
+ 
+ 	if (hba->clientcert)
+ 	{
+ 		hba_add_jsonb_string_key(&parseState, "clientcert");
+ 		hba_add_jsonb_bool_value(&parseState, true);
+ 	}
+ 
+ 	if (hba->pamservice)
+ 	{
+ 		hba_add_jsonb_string_key(&parseState, "pamservice");
+ 		hba_add_jsonb_string_value(&parseState, hba->pamservice);
+ 	}
+ 
+ 	if (hba->auth_method == uaLDAP)
+ 	{
+ 		if (hba->ldapserver)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapserver");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapserver);
+ 		}
+ 
+ 		if (hba->ldapport)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapport");
+ 			hba_add_jsonb_int32_value(&parseState, hba->ldapport);
+ 		}
+ 
+ 		if (hba->ldaptls)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldaptls");
+ 			hba_add_jsonb_bool_value(&parseState, true);
+ 		}
+ 
+ 		if (hba->ldapprefix)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapprefix");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapprefix);
+ 		}
+ 
+ 		if (hba->ldapsuffix)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapsuffix");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapsuffix);
+ 		}
+ 
+ 		if (hba->ldapbasedn)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapbasedn");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapbasedn);
+ 		}
+ 
+ 		if (hba->ldapbinddn)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapbinddn");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapbinddn);
+ 		}
+ 
+ 		if (hba->ldapbindpasswd)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapbindpasswd");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapbindpasswd);
+ 		}
+ 
+ 		if (hba->ldapsearchattribute)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapsearchattribute");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapsearchattribute);
+ 		}
+ 
+ 		if (hba->ldapscope)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapscope");
+ 			hba_add_jsonb_int32_value(&parseState, hba->ldapscope);
+ 		}
+ 	}
+ 
+ 	if (hba->auth_method == uaRADIUS)
+ 	{
+ 		if (hba->radiusserver)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiusserver");
+ 			hba_add_jsonb_string_value(&parseState, hba->radiusserver);
+ 		}
+ 
+ 		if (hba->radiussecret)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiussecret");
+ 			hba_add_jsonb_string_value(&parseState, hba->radiussecret);
+ 		}
+ 
+ 		if (hba->radiusidentifier)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiusidentifier");
+ 			hba_add_jsonb_string_value(&parseState, hba->radiusidentifier);
+ 		}
+ 
+ 		if (hba->radiusport)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiusport");
+ 			hba_add_jsonb_int32_value(&parseState, hba->radiusport);
+ 		}
+ 	}
+ 
+ 	result = pushJsonbValue(&parseState, WJB_END_OBJECT, NULL);
+ 	values[index] = PointerGetDatum(JsonbValueToJsonb(result));
+ 
+ 	/* reason */
+ 	index++;
+ 	if (!hba_match_result)
+ 		values[index] = CStringGetTextDatum(reason);
+ 	else
+ 		nulls[index] = true;
+ }
+ 
+ static bool
+ pg_hba_match(HbaLine *hba, char *database, char *user, struct sockaddr_storage * addr,
+ char *hostname, bool ssl_inuse, hba_lookup_args_mode args_mode, char *reason)
+ {
+ 	Oid			roleid;
+ 
+ 	if (ssl_inuse)
+ 	{
+ #ifdef USE_SSL
+ 		if (EnableSSL && hba->conntype != ctHostSSL)
+ 		{
+ 			strcpy(reason, "non SSL connection type");
+ 			return false;
+ 		}
+ 		else
+ 		{
+ 			ereport(ERROR,
+ 					(errcode(ERRCODE_CONFIG_FILE_ERROR),
+ 					 errmsg("hostssl requires SSL to be turned on"),
+ 					 errhint("Set ssl = on in postgresql.conf.")));
+ 			return false;
+ 		}
+ #else
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_CONFIG_FILE_ERROR),
+ 				 errmsg("hostssl is not supported by this build"),
+ 			errhint("Compile with --with-openssl to use SSL connections.")));
+ 		return false;
+ #endif
+ 	}
+ 
+ 	/* Get the target role's OID.  Note we do not error out for bad role. */
+ 	roleid = get_role_oid(user, true);
+ 
+ 	if (!check_db(database, user, roleid, hba->databases))
+ 	{
+ 		strcpy(reason, "non matching database");
+ 		return false;
+ 	}
+ 
+ 	if (!check_role(user, roleid, hba->roles))
+ 	{
+ 		strcpy(reason, "non matching role");
+ 		return false;
+ 	}
+ 
+ 	if (args_mode != TWO_ARGS_MODE)
+ 	{
+ 		/* Check IP address */
+ 		switch (hba->ip_cmp_method)
+ 		{
+ 			case ipCmpMask:
+ 				if (hostname && hba->hostname)
+ 				{
+ 					if (!hostname_match(hostname, hba->hostname))
+ 					{
+ 						strcpy(reason, "non matching hostname");
+ 						return false;
+ 					}
+ 				}
+ 				else
+ 				{
+ 					if (!check_ip((SockAddr *) addr,
+ 								  (struct sockaddr *) & hba->addr,
+ 								  (struct sockaddr *) & hba->mask))
+ 					{
+ 						strcpy(reason, "non matching IP");
+ 						return false;
+ 					}
+ 				}
+ 				break;
+ 			case ipCmpAll:
+ 				break;
+ 			case ipCmpSameHost:
+ 			case ipCmpSameNet:
+ 				if (!check_same_host_or_net((SockAddr *) addr,
+ 											hba->ip_cmp_method))
+ 				{
+ 					strcpy(reason, "non matching SameHost/SameNet");
+ 					return false;
+ 				}
+ 				break;
+ 			default:			/* Not reachable case */
+ 				break;
+ 		}
+ 	}
+ 
+ 	return true;
+ }
+ 
+ 
+ #define NUM_PG_HBA_CONF_ATTS   10
+ 
+ static void
+ pg_hba_lookup_internal(char *database, char *user, struct sockaddr_storage * addr,
+ 					   char *hostname, bool ssl_inuse, hba_lookup_args_mode args_mode, ReturnSetInfo *rsi)
+ {
+ 	Tuplestorestate *tuple_store;
+ 	TupleDesc	tupdesc;
+ 	ListCell   *line;
+ 	MemoryContext old_cxt;
+ 
+ 	/*
+ 	 * Create the tupledesc and tuplestore in the per_query context as
+ 	 * required for SFRM_Materialize.
+ 	 */
+ 	old_cxt = MemoryContextSwitchTo(rsi->econtext->ecxt_per_query_memory);
+ 
+ 	tupdesc = CreateTemplateTupleDesc(NUM_PG_HBA_CONF_ATTS, false);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 1, "line_number",
+ 					   INT4OID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 2, "mode",
+ 					   TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 3, "type",
+ 					   TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 4, "database",
+ 					   JSONBOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 5, "user",
+ 					   JSONBOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 6, "address",
+ 					   INETOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 7, "hostname",
+ 					   TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 8, "method",
+ 					   TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 9, "options",
+ 					   JSONBOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 10, "reason",
+ 					   TEXTOID, -1, 0);
+ 	BlessTupleDesc(tupdesc);
+ 
+ 	tuple_store =
+ 		tuplestore_begin_heap(rsi->allowedModes & SFRM_Materialize_Random,
+ 							  false, work_mem);
+ 
+ 	MemoryContextSwitchTo(old_cxt);
+ 
+ 	/*
+ 	 * Loop through the list and deparse each entry as it comes, storing it in
+ 	 * the tuplestore. Any temporary memory allocations here live only for the
+ 	 * function call lifetime.
+ 	 */
+ 	foreach(line, parsed_hba_lines)
+ 	{
+ 		HbaLine    *hba = (HbaLine *) lfirst(line);
+ 		Datum		values[NUM_PG_HBA_CONF_ATTS];
+ 		bool		nulls[NUM_PG_HBA_CONF_ATTS];
+ 		HeapTuple	tuple;
+ 		bool		hba_match_result;
+ 		char		reason[MAX_LEN_OF_NON_MATCH_HBA_ENTRY_REASON];
+ 
+ 		memset(values, 0, sizeof(values));
+ 		memset(nulls, 0, sizeof(nulls));
+ 
+ 		CHECK_FOR_INTERRUPTS();
+ 
+ 		hba_match_result = pg_hba_match(hba, database, user, addr, hostname,
+ 										ssl_inuse, args_mode, reason);
+ 
+ 		/* Get the next parsed hba line values */
+ 		hba_getvalues_for_line(hba, values, nulls, hba_match_result, reason);
+ 
+ 		/* build a tuple */
+ 		tuple = heap_form_tuple(tupdesc, values, nulls);
+ 		tuplestore_puttuple(tuple_store, tuple);
+ 
+ 		/* Stop the loop processing, if matching entry is found */
+ 		if (hba_match_result)
+ 			break;
+ 	}
+ 
+ 	rsi->setDesc = tupdesc;
+ 	rsi->setResult = tuple_store;
+ 	return;
+ }
+ 
+ /*
+ * SQL-accessible SRF to return all the settings from the pg_hba.conf
+ * file.
+ */
+ Datum
+ pg_hba_lookup_2args(PG_FUNCTION_ARGS)
+ {
+ 	return pg_hba_lookup(fcinfo);
+ }
+ 
+ /*
+  * SQL-accessible SRF to return all the settings from the pg_hba.conf
+  * file.
+  */
+ Datum
+ pg_hba_lookup_3args(PG_FUNCTION_ARGS)
+ {
+ 	return pg_hba_lookup(fcinfo);
+ }
+ 
+ /*
+  * SQL-accessible SRF to return all the settings from the pg_hba.conf
+  * file.
+  */
+ Datum
+ pg_hba_lookup(PG_FUNCTION_ARGS)
+ {
+ 	char	   *user;
+ 	char	   *database;
+ 	char	   *address;
+ 	char	   *hostname;
+ 	bool		ssl_inuse = false;
+ 	struct sockaddr_storage addr;
+ 	hba_lookup_args_mode args_mode = TWO_ARGS_MODE;		/* Minimum number of
+ 														 * arguments */
+ 
+ 	/*
+ 	 * We must use the Materialize mode to be safe against HBA file reloads
+ 	 * while the cursor is open. It's also more efficient than having to look
+ 	 * up our current position in the parsed list every time.
+ 	 */
+ 	ReturnSetInfo *rsi = (ReturnSetInfo *) fcinfo->resultinfo;
+ 
+ 	if (!superuser())
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+ 				 (errmsg("must be superuser to view pg_hba.conf settings"))));
+ 
+ 	if (!rsi || !IsA(rsi, ReturnSetInfo) ||
+ 		(rsi->allowedModes & SFRM_Materialize) == 0)
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+ 				 errmsg("set-valued function called in context that "
+ 						"cannot accept a set")));
+ 
+ 	if (PG_ARGISNULL(0))
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+ 				 (errmsg("database name is required to match pg_hba configuration entry"))));
+ 	else
+ 		database = TextDatumGetCString(PG_GETARG_DATUM(0));
+ 
+ 	if (PG_ARGISNULL(1))
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+ 				 (errmsg("user name is required to match pg_hba configuration entry"))));
+ 	else
+ 		user = TextDatumGetCString(PG_GETARG_DATUM(1));
+ 
+ 	if (PG_NARGS() != 2)
+ 	{
+ 		struct addrinfo *gai_result;
+ 		struct addrinfo hints;
+ 		int			ret;
+ 
+ 		args_mode = THREE_ARGS_MODE;
+ 		if (!PG_ARGISNULL(2))
+ 			address = TextDatumGetCString(PG_GETARG_DATUM(2));
+ 
+ 		/* Get the IP address either way */
+ 		hints.ai_flags = AI_NUMERICHOST;
+ 		hints.ai_family = AF_UNSPEC;
+ 		hints.ai_socktype = 0;
+ 		hints.ai_protocol = 0;
+ 		hints.ai_addrlen = 0;
+ 		hints.ai_canonname = NULL;
+ 		hints.ai_addr = NULL;
+ 		hints.ai_next = NULL;
+ 
+ 		ret = pg_getaddrinfo_all(address, NULL, &hints, &gai_result);
+ 		if (ret == 0 && gai_result)
+ 			memcpy(&addr, gai_result->ai_addr, gai_result->ai_addrlen);
+ 		else if (ret == EAI_NONAME)
+ 			hostname = pstrdup(address);
+ 		else
+ 		{
+ 			ereport(ERROR,
+ 					(errmsg("invalid IP address \"%s\": %s",
+ 							address, gai_strerror(ret))));
+ 			if (gai_result)
+ 				pg_freeaddrinfo_all(hints.ai_family, gai_result);
+ 			return false;
+ 		}
+ 
+ 		pg_freeaddrinfo_all(hints.ai_family, gai_result);
+ 
+ 		if (PG_NARGS() != 3)
+ 		{
+ 			args_mode = FOUR_ARGS_MODE;
+ 			if (!PG_ARGISNULL(3))
+ 				ssl_inuse = DatumGetBool(PG_GETARG_DATUM(3));
+ 		}
+ 	}
+ 
+ 	if (load_hba_failure)
+ 		ereport(WARNING,
+ 			 (errmsg("There was some failure in reloading pg_hba.conf file. "
+ 		   "The pg_hba.conf settings data may contains stale information")));
+ 
+ 	rsi->returnMode = SFRM_Materialize;
+ 
+ 	pg_hba_lookup_internal(database, user, &addr, hostname, ssl_inuse, args_mode, rsi);
+ 
+ 	PG_RETURN_NULL();
+ }
*** a/src/backend/tcop/postgres.c
--- b/src/backend/tcop/postgres.c
***************
*** 4005,4010 **** PostgresMain(int argc, char *argv[],
--- 4005,4022 ----
  		{
  			got_SIGHUP = false;
  			ProcessConfigFile(PGC_SIGHUP);
+ 
+ 			/* 
+ 			 * Reload authentication config files too to refresh 
+ 			 * pg_hba_conf view data.
+ 			 */
+ 			load_hba_failure = false;
+ 			if (!load_hba())
+ 			{
+ 				ereport(DEBUG1,
+ 					(errmsg("Falure in reloading pg_hba.conf, pg_hba_conf view may show stale information")));
+ 				load_hba_failure = true;
+ 			}
  		}
  
  		/*
*** a/src/include/catalog/pg_proc.h
--- b/src/include/catalog/pg_proc.h
***************
*** 3079,3084 **** DATA(insert OID = 2084 (  pg_show_all_settings	PGNSP PGUID 12 1 1000 0 0 f f f f
--- 3079,3090 ----
  DESCR("SHOW ALL as a function");
  DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
  DESCR("show config file settings");
+ DATA(insert OID = 3997 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f t t v u 2 0 2249 "25 25" "{25,25,23,25,25,3802,3802,869,25,25,3802,25}" "{i,i,o,o,o,o,o,o,o,o,o,o}" "{database,user,line_number,mode,type,database,user,address,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup_2args _null_ _null_ _null_));
+ DESCR("view client authentication settings");
+ DATA(insert OID = 3998 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f t t v u 3 0 2249 "25 25 25" "{25,25,25,23,25,25,3802,3802,869,25,25,3802,25}" "{i,i,i,o,o,o,o,o,o,o,o,o,o}" "{database,user,address,line_number,mode,type,database,user,address,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup_3args _null_ _null_ _null_));
+ DESCR("view client authentication settings");
+ DATA(insert OID = 3999 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f t t v u 4 0 2249 "25 25 25 16" "{25,25,25,16,23,25,25,3802,3802,869,25,25,3802,25}" "{i,i,i,i,o,o,o,o,o,o,o,o,o,o}" "{database,user,address,ssl_inuse,line_number,mode,type,database,user,address,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+ DESCR("view client authentication settings");
  DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
  DESCR("view system lock information");
  DATA(insert OID = 1065 (  pg_prepared_xact PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{28,25,1184,26,26}" "{o,o,o,o,o}" "{transaction,gid,prepared,ownerid,dbid}" _null_ _null_ pg_prepared_xact _null_ _null_ _null_ ));
*** a/src/include/libpq/hba.h
--- b/src/include/libpq/hba.h
***************
*** 96,101 **** typedef struct IdentLine
--- 96,103 ----
  /* kluge to avoid including libpq/libpq-be.h here */
  typedef struct Port hbaPort;
  
+ extern bool load_hba_failure;
+ 
  extern bool load_hba(void);
  extern bool load_ident(void);
  extern void hba_getauthmethod(hbaPort *port);
*** a/src/include/utils/builtins.h
--- b/src/include/utils/builtins.h
***************
*** 1123,1128 **** extern Datum set_config_by_name(PG_FUNCTION_ARGS);
--- 1123,1133 ----
  extern Datum show_all_settings(PG_FUNCTION_ARGS);
  extern Datum show_all_file_settings(PG_FUNCTION_ARGS);
  
+ /* hba.c */
+ extern Datum pg_hba_lookup_2args(PG_FUNCTION_ARGS);
+ extern Datum pg_hba_lookup_3args(PG_FUNCTION_ARGS);
+ extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
+ 
  /* rls.c */
  extern Datum row_security_active(PG_FUNCTION_ARGS);
  extern Datum row_security_active_name(PG_FUNCTION_ARGS);

*** a/src/backend/libpq/hba.c
--- b/src/backend/libpq/hba.c
***************
*** 386,392 **** tokenize_file(const char *filename, FILE *file,
  	MemoryContext linecxt;
  	MemoryContext oldcxt;
  
! 	linecxt = AllocSetContextCreate(CurrentMemoryContext,
  									"tokenize file cxt",
  									ALLOCSET_DEFAULT_MINSIZE,
  									ALLOCSET_DEFAULT_INITSIZE,
--- 386,392 ----
  	MemoryContext linecxt;
  	MemoryContext oldcxt;
  
! 	linecxt = AllocSetContextCreate(TopMemoryContext,
  									"tokenize file cxt",
  									ALLOCSET_DEFAULT_MINSIZE,
  									ALLOCSET_DEFAULT_INITSIZE,
***************
*** 1770,1777 **** load_hba(void)
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	Assert(PostmasterContext);
! 	hbacxt = AllocSetContextCreate(PostmasterContext,
  								   "hba parser context",
  								   ALLOCSET_DEFAULT_MINSIZE,
  								   ALLOCSET_DEFAULT_MINSIZE,
--- 1770,1776 ----
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	hbacxt = AllocSetContextCreate(TopMemoryContext,
  								   "hba parser context",
  								   ALLOCSET_DEFAULT_MINSIZE,
  								   ALLOCSET_DEFAULT_MINSIZE,
***************
*** 2148,2155 **** load_ident(void)
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	Assert(PostmasterContext);
! 	ident_context = AllocSetContextCreate(PostmasterContext,
  										  "ident parser context",
  										  ALLOCSET_DEFAULT_MINSIZE,
  										  ALLOCSET_DEFAULT_MINSIZE,
--- 2147,2153 ----
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	ident_context = AllocSetContextCreate(TopMemoryContext,
  										  "ident parser context",
  										  ALLOCSET_DEFAULT_MINSIZE,
  										  ALLOCSET_DEFAULT_MINSIZE,
*** a/src/backend/utils/init/postinit.c
--- b/src/backend/utils/init/postinit.c
***************
*** 52,58 ****
  #include "utils/acl.h"
  #include "utils/fmgroids.h"
  #include "utils/guc.h"
- #include "utils/memutils.h"
  #include "utils/pg_locale.h"
  #include "utils/portal.h"
  #include "utils/ps_status.h"
--- 52,57 ----
***************
*** 191,208 **** PerformAuthentication(Port *port)
  	 * FIXME: [fork/exec] Ugh.  Is there a way around this overhead?
  	 */
  #ifdef EXEC_BACKEND
- 	/*
- 	 * load_hba() and load_ident() want to work within the PostmasterContext,
- 	 * so create that if it doesn't exist (which it won't).  We'll delete it
- 	 * again later, in PostgresMain.
- 	 */
- 	if (PostmasterContext == NULL)
- 		PostmasterContext = AllocSetContextCreate(TopMemoryContext,
- 												  "Postmaster",
- 												  ALLOCSET_DEFAULT_MINSIZE,
- 												  ALLOCSET_DEFAULT_INITSIZE,
- 												  ALLOCSET_DEFAULT_MAXSIZE);
- 
  	if (!load_hba())
  	{
  		/*
--- 190,195 ----

*** a/src/backend/libpq/hba.c
--- b/src/backend/libpq/hba.c
***************
*** 1770,1777 **** load_hba(void)
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	Assert(PostmasterContext);
! 	hbacxt = AllocSetContextCreate(PostmasterContext,
  								   "hba parser context",
  								   ALLOCSET_DEFAULT_MINSIZE,
  								   ALLOCSET_DEFAULT_MINSIZE,
--- 1770,1776 ----
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	hbacxt = AllocSetContextCreate(TopMemoryContext,
  								   "hba parser context",
  								   ALLOCSET_DEFAULT_MINSIZE,
  								   ALLOCSET_DEFAULT_MINSIZE,
***************
*** 2148,2155 **** load_ident(void)
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	Assert(PostmasterContext);
! 	ident_context = AllocSetContextCreate(PostmasterContext,
  										  "ident parser context",
  										  ALLOCSET_DEFAULT_MINSIZE,
  										  ALLOCSET_DEFAULT_MINSIZE,
--- 2147,2153 ----
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	ident_context = AllocSetContextCreate(TopMemoryContext,
  										  "ident parser context",
  										  ALLOCSET_DEFAULT_MINSIZE,
  										  ALLOCSET_DEFAULT_MINSIZE,
*** a/src/backend/utils/init/postinit.c
--- b/src/backend/utils/init/postinit.c
***************
*** 52,58 ****
  #include "utils/acl.h"
  #include "utils/fmgroids.h"
  #include "utils/guc.h"
- #include "utils/memutils.h"
  #include "utils/pg_locale.h"
  #include "utils/portal.h"
  #include "utils/ps_status.h"
--- 52,57 ----
***************
*** 191,208 **** PerformAuthentication(Port *port)
  	 * FIXME: [fork/exec] Ugh.  Is there a way around this overhead?
  	 */
  #ifdef EXEC_BACKEND
- 	/*
- 	 * load_hba() and load_ident() want to work within the PostmasterContext,
- 	 * so create that if it doesn't exist (which it won't).  We'll delete it
- 	 * again later, in PostgresMain.
- 	 */
- 	if (PostmasterContext == NULL)
- 		PostmasterContext = AllocSetContextCreate(TopMemoryContext,
- 												  "Postmaster",
- 												  ALLOCSET_DEFAULT_MINSIZE,
- 												  ALLOCSET_DEFAULT_INITSIZE,
- 												  ALLOCSET_DEFAULT_MAXSIZE);
- 
  	if (!load_hba())
  	{
  		/*
--- 190,195 ----

*** a/doc/src/sgml/func.sgml
--- b/doc/src/sgml/func.sgml
***************
*** 16576,16581 **** SELECT collation for ('foo' COLLATE "de_DE");
--- 16576,16594 ----
         <entry><type>text</type></entry>
         <entry>set parameter and return new value</entry>
        </row>
+       <row>
+        <entry>
+         <indexterm>
+          <primary>pg_hba_lookup</primary>
+         </indexterm>
+         <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+                             <parameter>user_name</> <type>text</>
+                             [, <parameter>address</> <type>text</>]
+                             [, <parameter>ssl_inuse</> <type>text</>)</function></literal>
+        </entry>
+        <entry><type>record</type></entry>
+        <entry>Returns all row entries of pg_hba.conf till matching entry is found</entry>
+       </row>
       </tbody>
      </tgroup>
     </table>
***************
*** 16633,16638 **** SELECT set_config('log_statement_stats', 'off', false);
--- 16646,16668 ----
  </programlisting>
     </para>
  
+    <para>
+     <function>pg_hba_lookup</function> returns a set of records
+     containing the line number, mode, type, database, user_name,
+     address, hostname, method, options and reason. Typical usages
+     include:
+ <programlisting>
+ postgres=# select * from pg_hba_lookup('postgres','kommih', '::1');
+  line_number |  mode   | type  | database | user_name |  address  | hostname | method | options |     reason      
+ -------------+---------+-------+----------+-----------+-----------+----------+--------+---------+-----------------
+           84 | skipped | local | ["all"]  | ["all"]   |           |          | trust  | {}      | non matching IP
+           86 | skipped | host  | ["all"]  | ["all"]   | 127.0.0.1 |          | trust  | {}      | non matching IP
+           88 | matched | host  | ["all"]  | ["all"]   | ::1       |          | trust  | {}      | 
+ (3 rows)
+ </programlisting>
+     Only super user can access this function to view the pg_hba entries.
+    </para>
+    
    </sect2>
  
    <sect2 id="functions-admin-signal">
*** a/src/backend/catalog/system_views.sql
--- b/src/backend/catalog/system_views.sql
***************
*** 940,942 **** RETURNS jsonb
--- 940,951 ----
  LANGUAGE INTERNAL
  STRICT IMMUTABLE
  AS 'jsonb_set';
+ 
+ CREATE OR REPLACE FUNCTION pg_hba_lookup(IN database text, IN user_name text,
+     IN address text default NULL, IN ssl_inuse boolean default false,
+ 	OUT line_number int, OUT mode text, OUT type text, OUT database jsonb,
+ 	OUT user_name jsonb, OUT address inet,	OUT hostname text, OUT method text,
+ 	OUT options jsonb, OUT reason text)
+ RETURNS SETOF RECORD
+ LANGUAGE INTERNAL
+ AS 'pg_hba_lookup';
*** a/src/backend/libpq/hba.c
--- b/src/backend/libpq/hba.c
***************
*** 25,39 ****
--- 25,45 ----
  #include <arpa/inet.h>
  #include <unistd.h>
  
+ #include "access/htup_details.h"
  #include "catalog/pg_collation.h"
+ #include "catalog/pg_type.h"
+ #include "funcapi.h"
  #include "libpq/ip.h"
  #include "libpq/libpq.h"
+ #include "miscadmin.h"
  #include "postmaster/postmaster.h"
  #include "regex/regex.h"
  #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "utils/acl.h"
+ #include "utils/builtins.h"
  #include "utils/guc.h"
+ #include "utils/jsonb.h"
  #include "utils/lsyscache.h"
  #include "utils/memutils.h"
  
***************
*** 52,57 ****
--- 58,65 ----
  #define MAX_TOKEN	256
  #define MAX_LINE	8192
  
+ #define MAX_LEN_OF_NON_MATCH_HBA_ENTRY_REASON 256
+ 
  /* callback data for check_network_callback */
  typedef struct check_network_data
  {
***************
*** 74,79 **** typedef struct HbaToken
--- 82,90 ----
  	bool		quoted;
  } HbaToken;
  
+ /* Flag to indicate the failure of reloading pg_hba.conf file */
+ bool		load_hba_failure = false;
+ 
  /*
   * pre-parsed content of HBA config file: list of HbaLine structs.
   * parsed_hba_context is the memory context where it lives.
***************
*** 99,104 **** static List *tokenize_inc_file(List *tokens, const char *outer_filename,
--- 110,127 ----
  				  const char *inc_filename);
  static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
  				   int line_num);
+ static Datum getauthmethod(UserAuth auth_method);
+ static void hba_add_jsonb_string_elem(JsonbParseState **pstate, char *string_elem);
+ static void hba_add_jsonb_string_key(JsonbParseState **pstate, char *string_key);
+ static void hba_add_jsonb_bool_value(JsonbParseState **pstate, bool bool_val);
+ static void hba_add_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val);
+ static void hba_add_jsonb_string_value(JsonbParseState **pstate, char *string_value);
+ static void hba_getvalues_for_line(HbaLine *hba, Datum *values, bool *nulls,
+ 					   bool hba_match_result, char *reason);
+ static bool pg_hba_match(HbaLine *hba, char *user, char *database, struct sockaddr_storage * addr,
+ 			 char *hostname, bool ssl_inuse, char *reason);
+ static void pg_hba_lookup_internal(char *database, char *user, struct sockaddr_storage * addr,
+ 					   char *hostname, bool ssl_inuse, ReturnSetInfo *rsi);
  
  /*
   * isblank() exists in the ISO C99 spec, but it's not very portable yet,
***************
*** 2233,2235 **** hba_getauthmethod(hbaPort *port)
--- 2256,2900 ----
  {
  	check_hba(port);
  }
+ 
+ /*
+  * Returns the Text Datum representation of authentication method
+  */
+ static Datum
+ getauthmethod(UserAuth auth_method)
+ {
+ 	Datum		result;
+ 
+ 	switch (auth_method)
+ 	{
+ 		case uaReject:
+ 			result = CStringGetTextDatum("reject");
+ 			break;
+ 		case uaTrust:
+ 			result = CStringGetTextDatum("trust");
+ 			break;
+ 		case uaIdent:
+ 			result = CStringGetTextDatum("ident");
+ 			break;
+ 		case uaPassword:
+ 			result = CStringGetTextDatum("password");
+ 			break;
+ 		case uaMD5:
+ 			result = CStringGetTextDatum("md5");
+ 			break;
+ 		case uaGSS:
+ 			result = CStringGetTextDatum("gss");
+ 			break;
+ 		case uaSSPI:
+ 			result = CStringGetTextDatum("sspi");
+ 			break;
+ 		case uaPAM:
+ 			result = CStringGetTextDatum("pam");
+ 			break;
+ 		case uaLDAP:
+ 			result = CStringGetTextDatum("ldap");
+ 			break;
+ 		case uaCert:
+ 			result = CStringGetTextDatum("cert");
+ 			break;
+ 		case uaRADIUS:
+ 			result = CStringGetTextDatum("radius");
+ 			break;
+ 		case uaPeer:
+ 			result = CStringGetTextDatum("peer");
+ 			break;
+ 		default:
+ 			elog(ERROR, "unexpected authentication method in parsed HBA entry");
+ 			break;
+ 	}
+ 
+ 	return result;
+ }
+ 
+ static void
+ hba_add_jsonb_string_elem(JsonbParseState **pstate, char *string_elem)
+ {
+ 	JsonbValue	jb;
+ 
+ 	jb.type = jbvString;
+ 	jb.val.string.len = strlen(string_elem);
+ 	jb.val.string.val = pstrdup(string_elem);
+ 	pushJsonbValue(pstate, WJB_ELEM, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_string_key(JsonbParseState **pstate, char *string_key)
+ {
+ 	JsonbValue	jb;
+ 
+ 	jb.type = jbvString;
+ 	jb.val.string.len = strlen(string_key);
+ 	jb.val.string.val = pstrdup(string_key);
+ 	pushJsonbValue(pstate, WJB_KEY, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_bool_value(JsonbParseState **pstate, bool bool_val)
+ {
+ 	JsonbValue	jb;
+ 
+ 	jb.type = jbvBool;
+ 	jb.val.boolean = bool_val;
+ 
+ 	pushJsonbValue(pstate, WJB_VALUE, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val)
+ {
+ 	JsonbValue	jb;
+ 	char		outputstr[64];
+ 
+ 	sprintf(outputstr, "%d", int32_val);
+ 	jb.type = jbvNumeric;
+ 	jb.val.numeric = DatumGetNumeric(DirectFunctionCall3(numeric_in, CStringGetDatum(outputstr), 0, -1));
+ 
+ 	pushJsonbValue(pstate, WJB_VALUE, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_string_value(JsonbParseState **pstate, char *string_value)
+ {
+ 	JsonbValue	jb;
+ 
+ 	jb.type = jbvString;
+ 	jb.val.string.len = strlen(string_value);
+ 	jb.val.string.val = pstrdup(string_value);
+ 	pushJsonbValue(pstate, WJB_VALUE, &jb);
+ }
+ 
+ /*
+  * Fill in suitable values to build a tuple representing the
+  * HbaLine provided
+  */
+ static void
+ hba_getvalues_for_line(HbaLine *hba, Datum *values, bool *nulls, bool hba_match_result,
+ 					   char *reason)
+ {
+ 	ListCell   *dbcell;
+ 	char		buffer[NI_MAXHOST];
+ 	int			index = 0;
+ 	JsonbParseState *parseState = NULL;
+ 	JsonbValue *result;
+ 
+ 	/* line_number */
+ 	values[index] = Int32GetDatum(hba->linenumber);
+ 
+ 	/* mode */
+ 	index++;
+ 	if (hba_match_result)
+ 		values[index] = CStringGetTextDatum("matched");
+ 	else
+ 		values[index] = CStringGetTextDatum("skipped");
+ 
+ 	/* type */
+ 	index++;
+ 	switch (hba->conntype)
+ 	{
+ 		case ctLocal:
+ 			values[index] = CStringGetTextDatum("local");
+ 			break;
+ 		case ctHost:
+ 			values[index] = CStringGetTextDatum("host");
+ 			break;
+ 		case ctHostSSL:
+ 			values[index] = CStringGetTextDatum("hostssl");
+ 			break;
+ 		case ctHostNoSSL:
+ 			values[index] = CStringGetTextDatum("hostnossl");
+ 			break;
+ 		default:
+ 			elog(ERROR, "unexpected connection type in parsed HBA entry");
+ 			break;
+ 	}
+ 
+ 	/* database */
+ 	index++;
+ 	result = pushJsonbValue(&parseState, WJB_BEGIN_ARRAY, NULL);
+ 
+ 	if (list_length(hba->databases) != 0)
+ 	{
+ 		HbaToken   *tok;
+ 
+ 		foreach(dbcell, hba->databases)
+ 		{
+ 			tok = lfirst(dbcell);
+ 			hba_add_jsonb_string_elem(&parseState, tok->string);
+ 		}
+ 	}
+ 
+ 	result = pushJsonbValue(&parseState, WJB_END_ARRAY, NULL);
+ 	values[index] = PointerGetDatum(JsonbValueToJsonb(result));
+ 
+ 	/* user */
+ 	index++;
+ 	result = pushJsonbValue(&parseState, WJB_BEGIN_ARRAY, NULL);
+ 
+ 	if (list_length(hba->roles) != 0)
+ 	{
+ 		HbaToken   *tok;
+ 
+ 		foreach(dbcell, hba->roles)
+ 		{
+ 			tok = lfirst(dbcell);
+ 			hba_add_jsonb_string_elem(&parseState, tok->string);
+ 		}
+ 	}
+ 
+ 	result = pushJsonbValue(&parseState, WJB_END_ARRAY, NULL);
+ 	values[index] = PointerGetDatum(JsonbValueToJsonb(result));
+ 
+ 	/* address */
+ 	index++;
+ 	if (pg_getnameinfo_all(&hba->addr, sizeof(struct sockaddr_storage),
+ 						   buffer, sizeof(buffer),
+ 						   NULL, 0,
+ 						   NI_NUMERICHOST) == 0)
+ 	{
+ 		clean_ipv6_addr(hba->addr.ss_family, buffer);
+ 		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+ 	}
+ 	else
+ 		nulls[index] = true;
+ 
+ 	/* hostname */
+ 	index++;
+ 	if (hba->hostname)
+ 		values[index] = CStringGetTextDatum(hba->hostname);
+ 	else
+ 		nulls[index] = true;
+ 
+ 	/* method */
+ 	index++;
+ 	values[index] = getauthmethod(hba->auth_method);
+ 
+ 	/* options */
+ 	index++;
+ 	result = pushJsonbValue(&parseState, WJB_BEGIN_OBJECT, NULL);
+ 
+ 	if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
+ 	{
+ 		if (hba->include_realm)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "include_realm");
+ 			hba_add_jsonb_bool_value(&parseState, true);
+ 		}
+ 
+ 		if (hba->krb_realm)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "krb_realm");
+ 			hba_add_jsonb_string_value(&parseState, hba->krb_realm);
+ 		}
+ 	}
+ 
+ 	if (hba->usermap)
+ 	{
+ 		hba_add_jsonb_string_key(&parseState, "map");
+ 		hba_add_jsonb_string_value(&parseState, hba->usermap);
+ 	}
+ 
+ 	if (hba->clientcert)
+ 	{
+ 		hba_add_jsonb_string_key(&parseState, "clientcert");
+ 		hba_add_jsonb_bool_value(&parseState, true);
+ 	}
+ 
+ 	if (hba->pamservice)
+ 	{
+ 		hba_add_jsonb_string_key(&parseState, "pamservice");
+ 		hba_add_jsonb_string_value(&parseState, hba->pamservice);
+ 	}
+ 
+ 	if (hba->auth_method == uaLDAP)
+ 	{
+ 		if (hba->ldapserver)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapserver");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapserver);
+ 		}
+ 
+ 		if (hba->ldapport)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapport");
+ 			hba_add_jsonb_int32_value(&parseState, hba->ldapport);
+ 		}
+ 
+ 		if (hba->ldaptls)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldaptls");
+ 			hba_add_jsonb_bool_value(&parseState, true);
+ 		}
+ 
+ 		if (hba->ldapprefix)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapprefix");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapprefix);
+ 		}
+ 
+ 		if (hba->ldapsuffix)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapsuffix");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapsuffix);
+ 		}
+ 
+ 		if (hba->ldapbasedn)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapbasedn");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapbasedn);
+ 		}
+ 
+ 		if (hba->ldapbinddn)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapbinddn");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapbinddn);
+ 		}
+ 
+ 		if (hba->ldapbindpasswd)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapbindpasswd");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapbindpasswd);
+ 		}
+ 
+ 		if (hba->ldapsearchattribute)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapsearchattribute");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapsearchattribute);
+ 		}
+ 
+ 		if (hba->ldapscope)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapscope");
+ 			hba_add_jsonb_int32_value(&parseState, hba->ldapscope);
+ 		}
+ 	}
+ 
+ 	if (hba->auth_method == uaRADIUS)
+ 	{
+ 		if (hba->radiusserver)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiusserver");
+ 			hba_add_jsonb_string_value(&parseState, hba->radiusserver);
+ 		}
+ 
+ 		if (hba->radiussecret)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiussecret");
+ 			hba_add_jsonb_string_value(&parseState, hba->radiussecret);
+ 		}
+ 
+ 		if (hba->radiusidentifier)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiusidentifier");
+ 			hba_add_jsonb_string_value(&parseState, hba->radiusidentifier);
+ 		}
+ 
+ 		if (hba->radiusport)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiusport");
+ 			hba_add_jsonb_int32_value(&parseState, hba->radiusport);
+ 		}
+ 	}
+ 
+ 	result = pushJsonbValue(&parseState, WJB_END_OBJECT, NULL);
+ 	values[index] = PointerGetDatum(JsonbValueToJsonb(result));
+ 
+ 	/* reason */
+ 	index++;
+ 	if (!hba_match_result)
+ 		values[index] = CStringGetTextDatum(reason);
+ 	else
+ 		nulls[index] = true;
+ }
+ 
+ static bool
+ pg_hba_match(HbaLine *hba, char *database, char *user, struct sockaddr_storage * addr,
+ 			 char *hostname, bool ssl_inuse, char *reason)
+ {
+ 	Oid			roleid;
+ 
+ 	if (ssl_inuse)
+ 	{
+ #ifdef USE_SSL
+ 		if (EnableSSL && hba->conntype != ctHostSSL)
+ 		{
+ 			strcpy(reason, "non SSL connection type");
+ 			return false;
+ 		}
+ 		else
+ 		{
+ 			ereport(ERROR,
+ 					(errcode(ERRCODE_CONFIG_FILE_ERROR),
+ 					 errmsg("hostssl requires SSL to be turned on"),
+ 					 errhint("Set ssl = on in postgresql.conf.")));
+ 			return false;
+ 		}
+ #else
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_CONFIG_FILE_ERROR),
+ 				 errmsg("hostssl is not supported by this build"),
+ 			errhint("Compile with --with-openssl to use SSL connections.")));
+ 		return false;
+ #endif
+ 	}
+ 
+ 	/* Get the target role's OID.  Note we do not error out for bad role. */
+ 	roleid = get_role_oid(user, true);
+ 
+ 	if (!check_db(database, user, roleid, hba->databases))
+ 	{
+ 		strcpy(reason, "non matching database");
+ 		return false;
+ 	}
+ 
+ 	if (!check_role(user, roleid, hba->roles))
+ 	{
+ 		strcpy(reason, "non matching role");
+ 		return false;
+ 	}
+ 
+ 	/* Check IP address */
+ 	switch (hba->ip_cmp_method)
+ 	{
+ 		case ipCmpMask:
+ 			if (hostname && hba->hostname)
+ 			{
+ 				if (!hostname_match(hostname, hba->hostname))
+ 				{
+ 					strcpy(reason, "non matching hostname");
+ 					return false;
+ 				}
+ 			}
+ 			else
+ 			{
+ 				if (addr && !check_ip((SockAddr *) addr,
+ 									  (struct sockaddr *) & hba->addr,
+ 									  (struct sockaddr *) & hba->mask))
+ 				{
+ 					strcpy(reason, "non matching IP");
+ 					return false;
+ 				}
+ 			}
+ 			break;
+ 		case ipCmpAll:
+ 			break;
+ 		case ipCmpSameHost:
+ 		case ipCmpSameNet:
+ 			if (addr && !check_same_host_or_net((SockAddr *) addr,
+ 												hba->ip_cmp_method))
+ 			{
+ 				strcpy(reason, "non matching SameHost/SameNet");
+ 				return false;
+ 			}
+ 			break;
+ 		default:				/* Not reachable case */
+ 			break;
+ 	}
+ 
+ 	return true;
+ }
+ 
+ 
+ #define NUM_PG_HBA_CONF_ATTS   10
+ 
+ static void
+ pg_hba_lookup_internal(char *database, char *user, struct sockaddr_storage * addr,
+ 					   char *hostname, bool ssl_inuse, ReturnSetInfo *rsi)
+ {
+ 	Tuplestorestate *tuple_store;
+ 	TupleDesc	tupdesc;
+ 	ListCell   *line;
+ 	MemoryContext old_cxt;
+ 	MemoryContext pg_hba_tuple_context;
+ 
+ 	/*
+ 	 * Create the tupledesc and tuplestore in the per_query context as
+ 	 * required for SFRM_Materialize.
+ 	 */
+ 	old_cxt = MemoryContextSwitchTo(rsi->econtext->ecxt_per_query_memory);
+ 
+ 	tupdesc = CreateTemplateTupleDesc(NUM_PG_HBA_CONF_ATTS, false);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 1, "line_number",
+ 					   INT4OID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 2, "mode",
+ 					   TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 3, "type",
+ 					   TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 4, "database",
+ 					   JSONBOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 5, "user_name",
+ 					   JSONBOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 6, "address",
+ 					   INETOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 7, "hostname",
+ 					   TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 8, "method",
+ 					   TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 9, "options",
+ 					   JSONBOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 10, "reason",
+ 					   TEXTOID, -1, 0);
+ 	BlessTupleDesc(tupdesc);
+ 
+ 	tuple_store =
+ 		tuplestore_begin_heap(rsi->allowedModes & SFRM_Materialize_Random,
+ 							  false, work_mem);
+ 
+ 	MemoryContextSwitchTo(old_cxt);
+ 
+ 	pg_hba_tuple_context = AllocSetContextCreate(CurrentMemoryContext,
+ 												 "pg_hba_lookup tuple cxt",
+ 												 ALLOCSET_DEFAULT_MINSIZE,
+ 												 ALLOCSET_DEFAULT_INITSIZE,
+ 												 ALLOCSET_DEFAULT_MAXSIZE);
+ 
+ 	/*
+ 	 * Loop through the list and deparse each entry as it comes, storing it in
+ 	 * the tuplestore. Any temporary memory allocations here live only for the
+ 	 * function call lifetime.
+ 	 */
+ 	foreach(line, parsed_hba_lines)
+ 	{
+ 		HbaLine    *hba = (HbaLine *) lfirst(line);
+ 		Datum		values[NUM_PG_HBA_CONF_ATTS];
+ 		bool		nulls[NUM_PG_HBA_CONF_ATTS];
+ 		HeapTuple	tuple;
+ 		bool		hba_match_result;
+ 		char		reason[MAX_LEN_OF_NON_MATCH_HBA_ENTRY_REASON];
+ 
+ 		memset(values, 0, sizeof(values));
+ 		memset(nulls, 0, sizeof(nulls));
+ 
+ 		CHECK_FOR_INTERRUPTS();
+ 
+ 		MemoryContextReset(pg_hba_tuple_context);
+ 		old_cxt = MemoryContextSwitchTo(pg_hba_tuple_context);
+ 
+ 		hba_match_result = pg_hba_match(hba, database, user, addr, hostname,
+ 										ssl_inuse, reason);
+ 
+ 		/* Get the next parsed hba line values */
+ 		hba_getvalues_for_line(hba, values, nulls, hba_match_result, reason);
+ 
+ 		MemoryContextSwitchTo(old_cxt);
+ 
+ 		/* build a tuple */
+ 		tuple = heap_form_tuple(tupdesc, values, nulls);
+ 		tuplestore_puttuple(tuple_store, tuple);
+ 
+ 		/* Stop the loop processing, if matching entry is found */
+ 		if (hba_match_result)
+ 			break;
+ 	}
+ 
+ 	MemoryContextDelete(pg_hba_tuple_context);
+ 
+ 	rsi->setDesc = tupdesc;
+ 	rsi->setResult = tuple_store;
+ 	return;
+ }
+ 
+ /*
+  * SQL-accessible SRF to return all the settings from the pg_hba.conf
+  * file.
+  */
+ Datum
+ pg_hba_lookup(PG_FUNCTION_ARGS)
+ {
+ 	char	   *user;
+ 	char	   *database;
+ 	char	   *address = NULL;
+ 	char	   *hostname = NULL;
+ 	bool		ssl_inuse = false;
+ 	struct sockaddr_storage addr;
+ 	struct sockaddr_storage *addr_ptr = NULL;
+ 
+ 	/*
+ 	 * We must use the Materialize mode to be safe against HBA file reloads
+ 	 * while the cursor is open. It's also more efficient than having to look
+ 	 * up our current position in the parsed list every time.
+ 	 */
+ 	ReturnSetInfo *rsi = (ReturnSetInfo *) fcinfo->resultinfo;
+ 
+ 	if (!superuser())
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+ 				 (errmsg("must be superuser to view pg_hba.conf settings"))));
+ 
+ 	if (!rsi || !IsA(rsi, ReturnSetInfo) ||
+ 		(rsi->allowedModes & SFRM_Materialize) == 0)
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+ 				 errmsg("set-valued function called in context that "
+ 						"cannot accept a set")));
+ 
+ 	if (PG_ARGISNULL(0))
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+ 				 (errmsg("database name is required to match pg_hba configuration entry"))));
+ 	else
+ 		database = TextDatumGetCString(PG_GETARG_DATUM(0));
+ 
+ 	if (PG_ARGISNULL(1))
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+ 				 (errmsg("user name is required to match pg_hba configuration entry"))));
+ 	else
+ 		user = TextDatumGetCString(PG_GETARG_DATUM(1));
+ 
+ 	if (!PG_ARGISNULL(2))
+ 	{
+ 		struct addrinfo *gai_result;
+ 		struct addrinfo hints;
+ 		int			ret;
+ 
+ 		address = TextDatumGetCString(PG_GETARG_DATUM(2));
+ 
+ 		/* Get the IP address either way */
+ 		hints.ai_flags = AI_NUMERICHOST;
+ 		hints.ai_family = AF_UNSPEC;
+ 		hints.ai_socktype = 0;
+ 		hints.ai_protocol = 0;
+ 		hints.ai_addrlen = 0;
+ 		hints.ai_canonname = NULL;
+ 		hints.ai_addr = NULL;
+ 		hints.ai_next = NULL;
+ 
+ 		ret = pg_getaddrinfo_all(address, NULL, &hints, &gai_result);
+ 		if (ret == 0 && gai_result)
+ 		{
+ 			memcpy(&addr, gai_result->ai_addr, gai_result->ai_addrlen);
+ 			addr_ptr = &addr;
+ 		}
+ 		else if (ret == EAI_NONAME)
+ 			hostname = pstrdup(address);
+ 		else
+ 		{
+ 			ereport(ERROR,
+ 					(errmsg("invalid IP address \"%s\": %s",
+ 							address, gai_strerror(ret))));
+ 			if (gai_result)
+ 				pg_freeaddrinfo_all(hints.ai_family, gai_result);
+ 			return false;
+ 		}
+ 
+ 		pg_freeaddrinfo_all(hints.ai_family, gai_result);
+ 	}
+ 
+ 	ssl_inuse = DatumGetBool(PG_GETARG_DATUM(3));
+ 
+ 	if (load_hba_failure)
+ 		ereport(WARNING,
+ 			 (errmsg("There was some failure in reloading pg_hba.conf file. "
+ 		   "The pg_hba.conf settings data may contains stale information")));
+ 
+ 	rsi->returnMode = SFRM_Materialize;
+ 
+ 	pg_hba_lookup_internal(database, user, addr_ptr, hostname, ssl_inuse, rsi);
+ 
+ 	PG_RETURN_NULL();
+ }
*** a/src/backend/tcop/postgres.c
--- b/src/backend/tcop/postgres.c
***************
*** 4005,4010 **** PostgresMain(int argc, char *argv[],
--- 4005,4022 ----
  		{
  			got_SIGHUP = false;
  			ProcessConfigFile(PGC_SIGHUP);
+ 
+ 			/* 
+ 			 * Reload authentication config files too to refresh 
+ 			 * pg_hba_conf view data.
+ 			 */
+ 			load_hba_failure = false;
+ 			if (!load_hba())
+ 			{
+ 				ereport(DEBUG1,
+ 					(errmsg("Falure in reloading pg_hba.conf, pg_hba_conf view may show stale information")));
+ 				load_hba_failure = true;
+ 			}
  		}
  
  		/*
*** a/src/include/catalog/pg_proc.h
--- b/src/include/catalog/pg_proc.h
***************
*** 3079,3084 **** DATA(insert OID = 2084 (  pg_show_all_settings	PGNSP PGUID 12 1 1000 0 0 f f f f
--- 3079,3086 ----
  DESCR("SHOW ALL as a function");
  DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
  DESCR("show config file settings");
+ DATA(insert OID = 3997 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f f t v u 4 0 2249 "25 25 25 16" "{25,25,25,16,23,25,25,3802,3802,869,25,25,3802,25}" "{i,i,i,i,o,o,o,o,o,o,o,o,o,o}" "{database,user_name,address,ssl_inuse,line_number,mode,type,database,user_name,address,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+ DESCR("view client authentication settings");
  DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
  DESCR("view system lock information");
  DATA(insert OID = 1065 (  pg_prepared_xact PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{28,25,1184,26,26}" "{o,o,o,o,o}" "{transaction,gid,prepared,ownerid,dbid}" _null_ _null_ pg_prepared_xact _null_ _null_ _null_ ));
*** a/src/include/libpq/hba.h
--- b/src/include/libpq/hba.h
***************
*** 96,101 **** typedef struct IdentLine
--- 96,103 ----
  /* kluge to avoid including libpq/libpq-be.h here */
  typedef struct Port hbaPort;
  
+ extern bool load_hba_failure;
+ 
  extern bool load_hba(void);
  extern bool load_ident(void);
  extern void hba_getauthmethod(hbaPort *port);
*** a/src/include/utils/builtins.h
--- b/src/include/utils/builtins.h
***************
*** 1123,1128 **** extern Datum set_config_by_name(PG_FUNCTION_ARGS);
--- 1123,1131 ----
  extern Datum show_all_settings(PG_FUNCTION_ARGS);
  extern Datum show_all_file_settings(PG_FUNCTION_ARGS);
  
+ /* hba.c */
+ extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
+ 
  /* rls.c */
  extern Datum row_security_active(PG_FUNCTION_ARGS);
  extern Datum row_security_active_name(PG_FUNCTION_ARGS);

*** a/doc/src/sgml/func.sgml
--- b/doc/src/sgml/func.sgml
***************
*** 16576,16581 **** SELECT collation for ('foo' COLLATE "de_DE");
--- 16576,16594 ----
         <entry><type>text</type></entry>
         <entry>set parameter and return new value</entry>
        </row>
+       <row>
+        <entry>
+         <indexterm>
+          <primary>pg_hba_lookup</primary>
+         </indexterm>
+         <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+                             <parameter>user_name</> <type>text</>
+                             [, <parameter>address</> <type>text</>]
+                             [, <parameter>ssl_inuse</> <type>text</>)</function></literal>
+        </entry>
+        <entry><type>record</type></entry>
+        <entry>Returns all row entries of pg_hba.conf till matching entry is found</entry>
+       </row>
       </tbody>
      </tgroup>
     </table>
***************
*** 16633,16638 **** SELECT set_config('log_statement_stats', 'off', false);
--- 16646,16669 ----
  </programlisting>
     </para>
  
+    <para>
+     <function>pg_hba_lookup</function> returns a set of records
+     containing the line number, mode, type, database, user_name,
+     address, hostname, method, options and reason. Typical usages
+     include:
+ <programlisting>
+ postgres=# select * from pg_hba_lookup('postgres', 'kommih','::1');
+  line_number |  mode   | type  | database | user_name |  address  | hostname | method | options |     reason      
+ -------------+---------+-------+----------+-----------+-----------+----------+--------+---------+-----------------
+           84 | skipped | local | {all}    | {all}     |           |          | trust  | {}      | non matching IP
+           86 | skipped | host  | {all}    | {all}     | 127.0.0.1 |          | trust  | {}      | non matching IP
+           88 | matched | host  | {all}    | {all}     | ::1       |          | trust  | {}      | 
+ (3 rows)
+ 
+ </programlisting>
+     Only super user can access this function to view the pg_hba entries.
+    </para>
+    
    </sect2>
  
    <sect2 id="functions-admin-signal">
*** a/src/backend/catalog/system_views.sql
--- b/src/backend/catalog/system_views.sql
***************
*** 948,950 **** RETURNS jsonb
--- 948,959 ----
  LANGUAGE INTERNAL
  STRICT IMMUTABLE
  AS 'jsonb_set';
+ 
+ CREATE OR REPLACE FUNCTION pg_hba_lookup(IN database text, IN user_name text,
+     IN address text default NULL, IN ssl_inuse boolean default false,
+ 	OUT line_number int, OUT mode text, OUT type text, OUT database _text,
+ 	OUT user_name _text, OUT address inet,	OUT hostname text, OUT method text,
+ 	OUT options jsonb, OUT reason text)
+ RETURNS SETOF RECORD
+ LANGUAGE INTERNAL
+ AS 'pg_hba_lookup';
*** a/src/backend/libpq/hba.c
--- b/src/backend/libpq/hba.c
***************
*** 25,39 ****
--- 25,46 ----
  #include <arpa/inet.h>
  #include <unistd.h>
  
+ #include "access/htup_details.h"
  #include "catalog/pg_collation.h"
+ #include "catalog/pg_type.h"
+ #include "catalog/objectaddress.h"
+ #include "funcapi.h"
  #include "libpq/ip.h"
  #include "libpq/libpq.h"
+ #include "miscadmin.h"
  #include "postmaster/postmaster.h"
  #include "regex/regex.h"
  #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "utils/acl.h"
+ #include "utils/builtins.h"
  #include "utils/guc.h"
+ #include "utils/jsonb.h"
  #include "utils/lsyscache.h"
  #include "utils/memutils.h"
  
***************
*** 52,57 ****
--- 59,67 ----
  #define MAX_TOKEN	256
  #define MAX_LINE	8192
  
+ #define NUM_PG_HBA_CONF_ATTS   10
+ #define MAX_LEN_OF_NON_MATCH_HBA_ENTRY_REASON 256
+ 
  /* callback data for check_network_callback */
  typedef struct check_network_data
  {
***************
*** 99,104 **** static List *tokenize_inc_file(List *tokens, const char *outer_filename,
--- 109,124 ----
  				  const char *inc_filename);
  static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
  				   int line_num);
+ static Datum getauthmethod(UserAuth auth_method);
+ static void hba_add_jsonb_string_key(JsonbParseState **pstate, char *string_key);
+ static void hba_add_jsonb_bool_value(JsonbParseState **pstate, bool bool_val);
+ static void hba_add_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val);
+ static void hba_add_jsonb_string_value(JsonbParseState **pstate, char *string_value);
+ static Jsonb *gethba_options(HbaLine *hba);
+ static void get_hbaline_values(char *database, char *user, struct sockaddr_storage * addr,
+ 				   char *hostname, bool ssl_inuse, ReturnSetInfo *rsi);
+ static bool pg_hba_lookup_match(HbaLine *hba, char *user, char *database, struct sockaddr_storage * addr,
+ 					char *hostname, bool ssl_inuse, char *reason);
  
  /*
   * isblank() exists in the ISO C99 spec, but it's not very portable yet,
***************
*** 1755,1760 **** load_hba(void)
--- 1775,1781 ----
  	MemoryContext linecxt;
  	MemoryContext oldcxt;
  	MemoryContext hbacxt;
+ 	MemoryContext parentcxt = (!IsUnderPostmaster) ? PostmasterContext : CurrentMemoryContext;
  
  	file = AllocateFile(HbaFileName, "r");
  	if (file == NULL)
***************
*** 1770,1777 **** load_hba(void)
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	Assert(PostmasterContext);
! 	hbacxt = AllocSetContextCreate(PostmasterContext,
  								   "hba parser context",
  								   ALLOCSET_DEFAULT_MINSIZE,
  								   ALLOCSET_DEFAULT_MINSIZE,
--- 1791,1798 ----
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	Assert(parentcxt);
! 	hbacxt = AllocSetContextCreate(parentcxt,
  								   "hba parser context",
  								   ALLOCSET_DEFAULT_MINSIZE,
  								   ALLOCSET_DEFAULT_MINSIZE,
***************
*** 1829,1835 **** load_hba(void)
  	}
  
  	/* Loaded new file successfully, replace the one we use */
! 	if (parsed_hba_context != NULL)
  		MemoryContextDelete(parsed_hba_context);
  	parsed_hba_context = hbacxt;
  	parsed_hba_lines = new_parsed_lines;
--- 1850,1856 ----
  	}
  
  	/* Loaded new file successfully, replace the one we use */
! 	if (!IsUnderPostmaster && parsed_hba_context != NULL)
  		MemoryContextDelete(parsed_hba_context);
  	parsed_hba_context = hbacxt;
  	parsed_hba_lines = new_parsed_lines;
***************
*** 2235,2237 **** hba_getauthmethod(hbaPort *port)
--- 2256,2885 ----
  {
  	check_hba(port);
  }
+ 
+ /*
+  * Returns the Text Datum representation of authentication method
+  */
+ static Datum
+ getauthmethod(UserAuth auth_method)
+ {
+ 	Datum		result;
+ 
+ 	switch (auth_method)
+ 	{
+ 		case uaReject:
+ 			result = CStringGetTextDatum("reject");
+ 			break;
+ 		case uaTrust:
+ 			result = CStringGetTextDatum("trust");
+ 			break;
+ 		case uaIdent:
+ 			result = CStringGetTextDatum("ident");
+ 			break;
+ 		case uaPassword:
+ 			result = CStringGetTextDatum("password");
+ 			break;
+ 		case uaMD5:
+ 			result = CStringGetTextDatum("md5");
+ 			break;
+ 		case uaGSS:
+ 			result = CStringGetTextDatum("gss");
+ 			break;
+ 		case uaSSPI:
+ 			result = CStringGetTextDatum("sspi");
+ 			break;
+ 		case uaPAM:
+ 			result = CStringGetTextDatum("pam");
+ 			break;
+ 		case uaLDAP:
+ 			result = CStringGetTextDatum("ldap");
+ 			break;
+ 		case uaCert:
+ 			result = CStringGetTextDatum("cert");
+ 			break;
+ 		case uaRADIUS:
+ 			result = CStringGetTextDatum("radius");
+ 			break;
+ 		case uaPeer:
+ 			result = CStringGetTextDatum("peer");
+ 			break;
+ 		default:
+ 			elog(ERROR, "unexpected authentication method in parsed HBA entry");
+ 			break;
+ 	}
+ 
+ 	return result;
+ }
+ 
+ static void
+ hba_add_jsonb_string_key(JsonbParseState **pstate, char *string_key)
+ {
+ 	JsonbValue	jb;
+ 
+ 	jb.type = jbvString;
+ 	jb.val.string.len = strlen(string_key);
+ 	jb.val.string.val = pstrdup(string_key);
+ 	pushJsonbValue(pstate, WJB_KEY, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_bool_value(JsonbParseState **pstate, bool bool_val)
+ {
+ 	JsonbValue	jb;
+ 
+ 	jb.type = jbvBool;
+ 	jb.val.boolean = bool_val;
+ 
+ 	pushJsonbValue(pstate, WJB_VALUE, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val)
+ {
+ 	JsonbValue	jb;
+ 	char		outputstr[64];
+ 
+ 	sprintf(outputstr, "%d", int32_val);
+ 	jb.type = jbvNumeric;
+ 	jb.val.numeric = DatumGetNumeric(DirectFunctionCall3(numeric_in, CStringGetDatum(outputstr), 0, -1));
+ 
+ 	pushJsonbValue(pstate, WJB_VALUE, &jb);
+ }
+ 
+ static void
+ hba_add_jsonb_string_value(JsonbParseState **pstate, char *string_value)
+ {
+ 	JsonbValue	jb;
+ 
+ 	jb.type = jbvString;
+ 	jb.val.string.len = strlen(string_value);
+ 	jb.val.string.val = pstrdup(string_value);
+ 	pushJsonbValue(pstate, WJB_VALUE, &jb);
+ }
+ 
+ static Jsonb *
+ gethba_options(HbaLine *hba)
+ {
+ 	JsonbParseState *parseState = NULL;
+ 	JsonbValue *result;
+ 
+ 	result = pushJsonbValue(&parseState, WJB_BEGIN_OBJECT, NULL);
+ 
+ 	if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
+ 	{
+ 		if (hba->include_realm)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "include_realm");
+ 			hba_add_jsonb_bool_value(&parseState, true);
+ 		}
+ 
+ 		if (hba->krb_realm)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "krb_realm");
+ 			hba_add_jsonb_string_value(&parseState, hba->krb_realm);
+ 		}
+ 	}
+ 
+ 	if (hba->usermap)
+ 	{
+ 		hba_add_jsonb_string_key(&parseState, "map");
+ 		hba_add_jsonb_string_value(&parseState, hba->usermap);
+ 	}
+ 
+ 	if (hba->clientcert)
+ 	{
+ 		hba_add_jsonb_string_key(&parseState, "clientcert");
+ 		hba_add_jsonb_bool_value(&parseState, true);
+ 	}
+ 
+ 	if (hba->pamservice)
+ 	{
+ 		hba_add_jsonb_string_key(&parseState, "pamservice");
+ 		hba_add_jsonb_string_value(&parseState, hba->pamservice);
+ 	}
+ 
+ 	if (hba->auth_method == uaLDAP)
+ 	{
+ 		if (hba->ldapserver)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapserver");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapserver);
+ 		}
+ 
+ 		if (hba->ldapport)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapport");
+ 			hba_add_jsonb_int32_value(&parseState, hba->ldapport);
+ 		}
+ 
+ 		if (hba->ldaptls)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldaptls");
+ 			hba_add_jsonb_bool_value(&parseState, true);
+ 		}
+ 
+ 		if (hba->ldapprefix)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapprefix");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapprefix);
+ 		}
+ 
+ 		if (hba->ldapsuffix)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapsuffix");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapsuffix);
+ 		}
+ 
+ 		if (hba->ldapbasedn)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapbasedn");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapbasedn);
+ 		}
+ 
+ 		if (hba->ldapbinddn)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapbinddn");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapbinddn);
+ 		}
+ 
+ 		if (hba->ldapbindpasswd)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapbindpasswd");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapbindpasswd);
+ 		}
+ 
+ 		if (hba->ldapsearchattribute)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapsearchattribute");
+ 			hba_add_jsonb_string_value(&parseState, hba->ldapsearchattribute);
+ 		}
+ 
+ 		if (hba->ldapscope)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "ldapscope");
+ 			hba_add_jsonb_int32_value(&parseState, hba->ldapscope);
+ 		}
+ 	}
+ 
+ 	if (hba->auth_method == uaRADIUS)
+ 	{
+ 		if (hba->radiusserver)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiusserver");
+ 			hba_add_jsonb_string_value(&parseState, hba->radiusserver);
+ 		}
+ 
+ 		if (hba->radiussecret)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiussecret");
+ 			hba_add_jsonb_string_value(&parseState, hba->radiussecret);
+ 		}
+ 
+ 		if (hba->radiusidentifier)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiusidentifier");
+ 			hba_add_jsonb_string_value(&parseState, hba->radiusidentifier);
+ 		}
+ 
+ 		if (hba->radiusport)
+ 		{
+ 			hba_add_jsonb_string_key(&parseState, "radiusport");
+ 			hba_add_jsonb_int32_value(&parseState, hba->radiusport);
+ 		}
+ 	}
+ 
+ 	result = pushJsonbValue(&parseState, WJB_END_OBJECT, NULL);
+ 	return JsonbValueToJsonb(result);
+ }
+ 
+ /*
+  * Fill in suitable values to build a tuple representing the
+  * HbaLine provided
+  */
+ static void
+ get_hbaline_values(char *database, char *user, struct sockaddr_storage * addr,
+ 				   char *hostname, bool ssl_inuse, ReturnSetInfo *rsi)
+ {
+ 	ListCell   *line;
+ 	Tuplestorestate *tuple_store;
+ 	TupleDesc	tupdesc;
+ 	MemoryContext old_cxt;
+ 	MemoryContext pg_hba_tuple_context;
+ 
+ 	/*
+ 	 * Create the tupledesc and tuplestore in the per_query context as
+ 	 * required for SFRM_Materialize.
+ 	 */
+ 	old_cxt = MemoryContextSwitchTo(rsi->econtext->ecxt_per_query_memory);
+ 
+ 	tupdesc = CreateTemplateTupleDesc(NUM_PG_HBA_CONF_ATTS, false);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 1, "line_number",
+ 					   INT4OID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 2, "mode",
+ 					   TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 3, "type",
+ 					   TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 4, "database",
+ 					   TEXTARRAYOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 5, "user_name",
+ 					   TEXTARRAYOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 6, "address",
+ 					   INETOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 7, "hostname",
+ 					   TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 8, "method",
+ 					   TEXTOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 9, "options",
+ 					   JSONBOID, -1, 0);
+ 	TupleDescInitEntry(tupdesc, (AttrNumber) 10, "reason",
+ 					   TEXTOID, -1, 0);
+ 	BlessTupleDesc(tupdesc);
+ 
+ 	tuple_store =
+ 		tuplestore_begin_heap(rsi->allowedModes & SFRM_Materialize_Random,
+ 							  false, work_mem);
+ 
+ 	MemoryContextSwitchTo(old_cxt);
+ 
+ 	pg_hba_tuple_context = AllocSetContextCreate(CurrentMemoryContext,
+ 												 "pg_hba_lookup tuple cxt",
+ 												 ALLOCSET_DEFAULT_MINSIZE,
+ 												 ALLOCSET_DEFAULT_INITSIZE,
+ 												 ALLOCSET_DEFAULT_MAXSIZE);
+ 
+ 	/*
+ 	 * Loop through the list and deparse each entry as it comes, storing it in
+ 	 * the tuplestore. Any temporary memory allocations here live only for the
+ 	 * function call lifetime.
+ 	 */
+ 	foreach(line, parsed_hba_lines)
+ 	{
+ 		HbaLine    *hba = (HbaLine *) lfirst(line);
+ 		Datum		values[NUM_PG_HBA_CONF_ATTS];
+ 		bool		nulls[NUM_PG_HBA_CONF_ATTS];
+ 		ListCell   *dbcell;
+ 		char		buffer[NI_MAXHOST];
+ 		char		reason[MAX_LEN_OF_NON_MATCH_HBA_ENTRY_REASON];
+ 		HeapTuple	tuple;
+ 		bool		hba_match_result;
+ 		int			index;
+ 
+ 		index = 0;
+ 		memset(values, 0, sizeof(values));
+ 		memset(nulls, 0, sizeof(nulls));
+ 
+ 		CHECK_FOR_INTERRUPTS();
+ 
+ 		MemoryContextReset(pg_hba_tuple_context);
+ 		old_cxt = MemoryContextSwitchTo(pg_hba_tuple_context);
+ 
+ 		hba_match_result = pg_hba_lookup_match(hba, database, user, addr, hostname,
+ 											   ssl_inuse, reason);
+ 
+ 		/* line_number */
+ 		values[index] = Int32GetDatum(hba->linenumber);
+ 
+ 		/* mode */
+ 		index++;
+ 		if (hba_match_result)
+ 			values[index] = CStringGetTextDatum("matched");
+ 		else
+ 			values[index] = CStringGetTextDatum("skipped");
+ 
+ 		/* type */
+ 		index++;
+ 		switch (hba->conntype)
+ 		{
+ 			case ctLocal:
+ 				values[index] = CStringGetTextDatum("local");
+ 				break;
+ 			case ctHost:
+ 				values[index] = CStringGetTextDatum("host");
+ 				break;
+ 			case ctHostSSL:
+ 				values[index] = CStringGetTextDatum("hostssl");
+ 				break;
+ 			case ctHostNoSSL:
+ 				values[index] = CStringGetTextDatum("hostnossl");
+ 				break;
+ 			default:
+ 				elog(ERROR, "unexpected connection type in parsed HBA entry");
+ 				break;
+ 		}
+ 
+ 		/* database */
+ 		index++;
+ 		if (list_length(hba->databases) != 0)
+ 		{
+ 			List	   *names = NULL;
+ 			HbaToken   *tok;
+ 
+ 			foreach(dbcell, hba->databases)
+ 			{
+ 				tok = lfirst(dbcell);
+ 				names = lappend(names, tok->string);
+ 			}
+ 
+ 			values[index] = PointerGetDatum(strlist_to_textarray(names));
+ 		}
+ 		else
+ 			nulls[index] = true;
+ 
+ 		/* user */
+ 		index++;
+ 		if (list_length(hba->roles) != 0)
+ 		{
+ 			List	   *roles = NULL;
+ 			HbaToken   *tok;
+ 
+ 			foreach(dbcell, hba->roles)
+ 			{
+ 				tok = lfirst(dbcell);
+ 				roles = lappend(roles, tok->string);
+ 			}
+ 
+ 			values[index] = PointerGetDatum(strlist_to_textarray(roles));
+ 		}
+ 		else
+ 			nulls[index] = true;
+ 
+ 		/* address */
+ 		index++;
+ 		if (pg_getnameinfo_all(&hba->addr, sizeof(struct sockaddr_storage),
+ 							   buffer, sizeof(buffer),
+ 							   NULL, 0,
+ 							   NI_NUMERICHOST) == 0)
+ 		{
+ 			clean_ipv6_addr(hba->addr.ss_family, buffer);
+ 			values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+ 		}
+ 		else
+ 			nulls[index] = true;
+ 
+ 		/* hostname */
+ 		index++;
+ 		if (hba->hostname)
+ 			values[index] = CStringGetTextDatum(hba->hostname);
+ 		else
+ 			nulls[index] = true;
+ 
+ 		/* method */
+ 		index++;
+ 		values[index] = getauthmethod(hba->auth_method);
+ 
+ 		/* options */
+ 		index++;
+ 		values[index] = PointerGetDatum(gethba_options(hba));
+ 
+ 		/* reason */
+ 		index++;
+ 		if (!hba_match_result)
+ 			values[index] = CStringGetTextDatum(reason);
+ 		else
+ 			nulls[index] = true;
+ 
+ 		MemoryContextSwitchTo(old_cxt);
+ 
+ 		/* build a tuple */
+ 		tuple = heap_form_tuple(tupdesc, values, nulls);
+ 		tuplestore_puttuple(tuple_store, tuple);
+ 
+ 		/* Stop the loop processing, if matching entry is found */
+ 		if (hba_match_result)
+ 			break;
+ 	}
+ 
+ 	MemoryContextDelete(pg_hba_tuple_context);
+ 
+ 	rsi->setDesc = tupdesc;
+ 	rsi->setResult = tuple_store;
+ 	return;
+ }
+ 
+ static bool
+ pg_hba_lookup_match(HbaLine *hba, char *database, char *user, struct sockaddr_storage * addr,
+ 					char *hostname, bool ssl_inuse, char *reason)
+ {
+ 	Oid			roleid;
+ 
+ 	if (ssl_inuse)
+ 	{
+ #ifdef USE_SSL
+ 		if (EnableSSL && hba->conntype != ctHostSSL)
+ 		{
+ 			strcpy(reason, "non SSL connection type");
+ 			return false;
+ 		}
+ 		else
+ 		{
+ 			ereport(ERROR,
+ 					(errcode(ERRCODE_CONFIG_FILE_ERROR),
+ 					 errmsg("hostssl requires SSL to be turned on"),
+ 					 errhint("Set ssl = on in postgresql.conf.")));
+ 			return false;
+ 		}
+ #else
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_CONFIG_FILE_ERROR),
+ 				 errmsg("hostssl is not supported by this build"),
+ 			errhint("Compile with --with-openssl to use SSL connections.")));
+ 		return false;
+ #endif
+ 	}
+ 
+ 	/* Get the target role's OID.  Note we do not error out for bad role. */
+ 	roleid = get_role_oid(user, true);
+ 
+ 	if (!check_db(database, user, roleid, hba->databases))
+ 	{
+ 		strcpy(reason, "non matching database");
+ 		return false;
+ 	}
+ 
+ 	if (!check_role(user, roleid, hba->roles))
+ 	{
+ 		strcpy(reason, "non matching role");
+ 		return false;
+ 	}
+ 
+ 	/* Check IP address */
+ 	switch (hba->ip_cmp_method)
+ 	{
+ 		case ipCmpMask:
+ 			if (hostname && hba->hostname)
+ 			{
+ 				if (!hostname_match(hostname, hba->hostname))
+ 				{
+ 					strcpy(reason, "non matching hostname");
+ 					return false;
+ 				}
+ 			}
+ 			else
+ 			{
+ 				if (addr && !check_ip((SockAddr *) addr,
+ 									  (struct sockaddr *) & hba->addr,
+ 									  (struct sockaddr *) & hba->mask))
+ 				{
+ 					strcpy(reason, "non matching IP");
+ 					return false;
+ 				}
+ 			}
+ 			break;
+ 		case ipCmpAll:
+ 			break;
+ 		case ipCmpSameHost:
+ 		case ipCmpSameNet:
+ 			if (addr && !check_same_host_or_net((SockAddr *) addr,
+ 												hba->ip_cmp_method))
+ 			{
+ 				strcpy(reason, "non matching SameHost/SameNet");
+ 				return false;
+ 			}
+ 			break;
+ 		default:				/* Not reachable case */
+ 			break;
+ 	}
+ 
+ 	return true;
+ }
+ 
+ /*
+  * SQL-accessible SRF to return all the settings from the pg_hba.conf
+  * file.
+  */
+ Datum
+ pg_hba_lookup(PG_FUNCTION_ARGS)
+ {
+ 	char	   *user;
+ 	char	   *database;
+ 	char	   *address = NULL;
+ 	char	   *hostname = NULL;
+ 	bool		ssl_inuse = false;
+ 	struct sockaddr_storage addr;
+ 	struct sockaddr_storage *addr_ptr = NULL;
+ 
+ 	/*
+ 	 * We must use the Materialize mode to be safe against HBA file reloads
+ 	 * while the cursor is open. It's also more efficient than having to look
+ 	 * up our current position in the parsed list every time.
+ 	 */
+ 	ReturnSetInfo *rsi = (ReturnSetInfo *) fcinfo->resultinfo;
+ 
+ 	if (!superuser())
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+ 				 (errmsg("must be superuser to view pg_hba.conf settings"))));
+ 
+ 	if (!rsi || !IsA(rsi, ReturnSetInfo) ||
+ 		(rsi->allowedModes & SFRM_Materialize) == 0)
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+ 				 errmsg("set-valued function called in context that "
+ 						"cannot accept a set")));
+ 
+ 	if (PG_ARGISNULL(0))
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+ 				 (errmsg("database name is required to match pg_hba configuration entry"))));
+ 	else
+ 		database = TextDatumGetCString(PG_GETARG_DATUM(0));
+ 
+ 	if (PG_ARGISNULL(1))
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+ 				 (errmsg("user name is required to match pg_hba configuration entry"))));
+ 	else
+ 		user = TextDatumGetCString(PG_GETARG_DATUM(1));
+ 
+ 	if (!PG_ARGISNULL(2))
+ 	{
+ 		struct addrinfo *gai_result;
+ 		struct addrinfo hints;
+ 		int			ret;
+ 
+ 		address = TextDatumGetCString(PG_GETARG_DATUM(2));
+ 
+ 		/* Get the IP address either way */
+ 		hints.ai_flags = AI_NUMERICHOST;
+ 		hints.ai_family = AF_UNSPEC;
+ 		hints.ai_socktype = 0;
+ 		hints.ai_protocol = 0;
+ 		hints.ai_addrlen = 0;
+ 		hints.ai_canonname = NULL;
+ 		hints.ai_addr = NULL;
+ 		hints.ai_next = NULL;
+ 
+ 		ret = pg_getaddrinfo_all(address, NULL, &hints, &gai_result);
+ 		if (ret == 0 && gai_result)
+ 		{
+ 			memcpy(&addr, gai_result->ai_addr, gai_result->ai_addrlen);
+ 			addr_ptr = &addr;
+ 		}
+ 		else if (ret == EAI_NONAME)
+ 			hostname = pstrdup(address);
+ 		else
+ 		{
+ 			ereport(ERROR,
+ 					(errmsg("invalid IP address \"%s\": %s",
+ 							address, gai_strerror(ret))));
+ 			if (gai_result)
+ 				pg_freeaddrinfo_all(hints.ai_family, gai_result);
+ 			return false;
+ 		}
+ 
+ 		pg_freeaddrinfo_all(hints.ai_family, gai_result);
+ 	}
+ 
+ 	ssl_inuse = DatumGetBool(PG_GETARG_DATUM(3));
+ 
+ 	rsi->returnMode = SFRM_Materialize;
+ 
+ 	if (!load_hba())
+ 		ereport(ERROR,
+ 			 (errmsg("There was some failure in loading pg_hba.conf file")));
+ 
+ 	/* Get the next parsed hba line values */
+ 	get_hbaline_values(database, user, addr_ptr, hostname, ssl_inuse, rsi);
+ 
+ 	PG_RETURN_NULL();
+ }
*** a/src/include/catalog/pg_proc.h
--- b/src/include/catalog/pg_proc.h
***************
*** 3079,3084 **** DATA(insert OID = 2084 (  pg_show_all_settings	PGNSP PGUID 12 1 1000 0 0 f f f f
--- 3079,3086 ----
  DESCR("SHOW ALL as a function");
  DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
  DESCR("show config file settings");
+ DATA(insert OID = 3997 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f f t v u 4 0 2249 "25 25 25 16" "{25,25,25,16,23,25,25,1009,1009,869,25,25,3802,25}" "{i,i,i,i,o,o,o,o,o,o,o,o,o,o}" "{database,user_name,address,ssl_inuse,line_number,mode,type,database,user_name,address,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+ DESCR("view client authentication settings");
  DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
  DESCR("view system lock information");
  DATA(insert OID = 1065 (  pg_prepared_xact PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{28,25,1184,26,26}" "{o,o,o,o,o}" "{transaction,gid,prepared,ownerid,dbid}" _null_ _null_ pg_prepared_xact _null_ _null_ _null_ ));
*** a/src/include/utils/builtins.h
--- b/src/include/utils/builtins.h
***************
*** 1123,1128 **** extern Datum set_config_by_name(PG_FUNCTION_ARGS);
--- 1123,1131 ----
  extern Datum show_all_settings(PG_FUNCTION_ARGS);
  extern Datum show_all_file_settings(PG_FUNCTION_ARGS);
  
+ /* hba.c */
+ extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
+ 
  /* rls.c */
  extern Datum row_security_active(PG_FUNCTION_ARGS);
  extern Datum row_security_active_name(PG_FUNCTION_ARGS);

*** a/doc/src/sgml/func.sgml
--- b/doc/src/sgml/func.sgml
***************
*** 16576,16581 **** SELECT collation for ('foo' COLLATE "de_DE");
--- 16576,16594 ----
         <entry><type>text</type></entry>
         <entry>set parameter and return new value</entry>
        </row>
+       <row>
+        <entry>
+         <indexterm>
+          <primary>pg_hba_lookup</primary>
+         </indexterm>
+         <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+                             <parameter>user_name</> <type>text</>
+                             [, <parameter>address</> <type>text</>]
+                             [, <parameter>ssl_inuse</> <type>text</>)</function></literal>
+        </entry>
+        <entry><type>record</type></entry>
+        <entry>Returns all row entries of pg_hba.conf till matching entry is found</entry>
+       </row>
       </tbody>
      </tgroup>
     </table>
***************
*** 16633,16638 **** SELECT set_config('log_statement_stats', 'off', false);
--- 16646,16669 ----
  </programlisting>
     </para>
  
+    <para>
+     <function>pg_hba_lookup</function> returns a set of records
+     containing the line number, mode, type, database, user_name,
+     address, hostname, method, options and reason. Typical usages
+     include:
+ <programlisting>
+ postgres=# select * from pg_hba_lookup('postgres', 'kommih','::1');
+  line_number |  mode   | type  | database | user_name |  address  | hostname | method | options |     reason      
+ -------------+---------+-------+----------+-----------+-----------+----------+--------+---------+-----------------
+           84 | skipped | local | {all}    | {all}     |           |          | trust  | {}      | non matching IP
+           86 | skipped | host  | {all}    | {all}     | 127.0.0.1 |          | trust  | {}      | non matching IP
+           88 | matched | host  | {all}    | {all}     | ::1       |          | trust  | {}      | 
+ (3 rows)
+ 
+ </programlisting>
+     Only super user can access this function to view the pg_hba entries.
+    </para>
+    
    </sect2>
  
    <sect2 id="functions-admin-signal">
*** a/src/backend/catalog/system_views.sql
--- b/src/backend/catalog/system_views.sql
***************
*** 948,950 **** RETURNS jsonb
--- 948,959 ----
  LANGUAGE INTERNAL
  STRICT IMMUTABLE
  AS 'jsonb_set';
+ 
+ CREATE OR REPLACE FUNCTION pg_hba_lookup(IN database text, IN user_name text,
+     IN address text default NULL, IN ssl_inuse boolean default false,
+ 	OUT line_number int, OUT mode text, OUT type text, OUT database _text,
+ 	OUT user_name _text, OUT address inet,	OUT hostname text, OUT method text,
+ 	OUT options jsonb, OUT reason text)
+ RETURNS SETOF RECORD
+ LANGUAGE INTERNAL
+ AS 'pg_hba_lookup';
*** a/src/backend/libpq/hba.c
--- b/src/backend/libpq/hba.c
***************
*** 25,39 ****
--- 25,46 ----
  #include <arpa/inet.h>
  #include <unistd.h>
  
+ #include "access/htup_details.h"
  #include "catalog/pg_collation.h"
+ #include "catalog/pg_type.h"
+ #include "catalog/objectaddress.h"
+ #include "funcapi.h"
  #include "libpq/ip.h"
  #include "libpq/libpq.h"
+ #include "miscadmin.h"
  #include "postmaster/postmaster.h"
  #include "regex/regex.h"
  #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "utils/acl.h"
+ #include "utils/builtins.h"
  #include "utils/guc.h"
+ #include "utils/jsonb.h"
  #include "utils/lsyscache.h"
  #include "utils/memutils.h"
  
***************
*** 52,57 ****
--- 59,67 ----
  #define MAX_TOKEN	256
  #define MAX_LINE	8192
  
+ #define NUM_PG_HBA_CONF_ATTS   10
+ #define MAX_LEN_OF_NON_MATCH_HBA_ENTRY_REASON 256
+ 
  /* callback data for check_network_callback */
  typedef struct check_network_data
  {
***************
*** 99,104 **** static List *tokenize_inc_file(List *tokens, const char *outer_filename,
--- 109,122 ----
  				  const char *inc_filename);
  static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
  				   int line_num);
+ static Datum getauthmethod(UserAuth auth_method);
+ static void hba_add_jsonb_string_key(JsonbParseState **pstate, char *string_key);
+ static void hba_add_jsonb_bool_value(JsonbParseState **pstate, bool bool_val);
+ static void hba_add_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val);
+ static void hba_add_jsonb_string_value(JsonbParseState **pstate, char *string_value);
+ static Jsonb *gethba_options(HbaLine *hba);
+ static void fill_hbaline(HbaLine *hba, TupleDesc tupdesc, Tuplestorestate *tuple_store,
+ 			 char *reason);
  
  /*
   * isblank() exists in the ISO C99 spec, but it's not very portable yet,
***************
*** 1640,1646 **** parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num)
   *	request.
   */
  static void
! check_hba(hbaPort *port)
  {
  	Oid			roleid;
  	ListCell   *line;
--- 1658,1664 ----
   *	request.
   */
  static void
! check_hba(hbaPort *port, TupleDesc tupdesc, Tuplestorestate *tuple_store)
  {
  	Oid			roleid;
  	ListCell   *line;
***************
*** 1657,1681 **** check_hba(hbaPort *port)
--- 1675,1711 ----
  		if (hba->conntype == ctLocal)
  		{
  			if (!IS_AF_UNIX(port->raddr.addr.ss_family))
+ 			{
+ 				fill_hbaline(hba, tupdesc, tuple_store, "non matching connection type");
  				continue;
+ 			}
  		}
  		else
  		{
  			if (IS_AF_UNIX(port->raddr.addr.ss_family))
+ 			{
+ 				fill_hbaline(hba, tupdesc, tuple_store, "non matching connection type");
  				continue;
+ 			}
  
  			/* Check SSL state */
  			if (port->ssl_in_use)
  			{
  				/* Connection is SSL, match both "host" and "hostssl" */
  				if (hba->conntype == ctHostNoSSL)
+ 				{
+ 					fill_hbaline(hba, tupdesc, tuple_store, "non matching connection type");
  					continue;
+ 				}
  			}
  			else
  			{
  				/* Connection is not SSL, match both "host" and "hostnossl" */
  				if (hba->conntype == ctHostSSL)
+ 				{
+ 					fill_hbaline(hba, tupdesc, tuple_store, "non matching connection type");
  					continue;
+ 				}
  			}
  
  			/* Check IP address */
***************
*** 1686,1699 **** check_hba(hbaPort *port)
--- 1716,1735 ----
  					{
  						if (!check_hostname(port,
  											hba->hostname))
+ 						{
+ 							fill_hbaline(hba, tupdesc, tuple_store, "non matching hostname");
  							continue;
+ 						}
  					}
  					else
  					{
  						if (!check_ip(&port->raddr,
  									  (struct sockaddr *) & hba->addr,
  									  (struct sockaddr *) & hba->mask))
+ 						{
+ 							fill_hbaline(hba, tupdesc, tuple_store, "non matching IP");
  							continue;
+ 						}
  					}
  					break;
  				case ipCmpAll:
***************
*** 1702,1708 **** check_hba(hbaPort *port)
--- 1738,1747 ----
  				case ipCmpSameNet:
  					if (!check_same_host_or_net(&port->raddr,
  												hba->ip_cmp_method))
+ 					{
+ 						fill_hbaline(hba, tupdesc, tuple_store, "non matching samehost/samenet");
  						continue;
+ 					}
  					break;
  				default:
  					/* shouldn't get here, but deem it no-match if so */
***************
*** 1713,1722 **** check_hba(hbaPort *port)
--- 1752,1769 ----
  		/* Check database and role */
  		if (!check_db(port->database_name, port->user_name, roleid,
  					  hba->databases))
+ 		{
+ 			fill_hbaline(hba, tupdesc, tuple_store, "non matching database name");
  			continue;
+ 		}
  
  		if (!check_role(port->user_name, roleid, hba->roles))
+ 		{
+ 			fill_hbaline(hba, tupdesc, tuple_store, "non matching user name");
  			continue;
+ 		}
+ 
+ 		fill_hbaline(hba, tupdesc, tuple_store, NULL);
  
  		/* Found a record that matched! */
  		port->hba = hba;
***************
*** 1755,1760 **** load_hba(void)
--- 1802,1808 ----
  	MemoryContext linecxt;
  	MemoryContext oldcxt;
  	MemoryContext hbacxt;
+ 	MemoryContext parentcxt = PostmasterContext ? PostmasterContext : CurrentMemoryContext;
  
  	file = AllocateFile(HbaFileName, "r");
  	if (file == NULL)
***************
*** 1770,1777 **** load_hba(void)
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	Assert(PostmasterContext);
! 	hbacxt = AllocSetContextCreate(PostmasterContext,
  								   "hba parser context",
  								   ALLOCSET_DEFAULT_MINSIZE,
  								   ALLOCSET_DEFAULT_MINSIZE,
--- 1818,1825 ----
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	Assert(parentcxt);
! 	hbacxt = AllocSetContextCreate(parentcxt,
  								   "hba parser context",
  								   ALLOCSET_DEFAULT_MINSIZE,
  								   ALLOCSET_DEFAULT_MINSIZE,
***************
*** 1828,1836 **** load_hba(void)
  		return false;
  	}
  
- 	/* Loaded new file successfully, replace the one we use */
- 	if (parsed_hba_context != NULL)
- 		MemoryContextDelete(parsed_hba_context);
  	parsed_hba_context = hbacxt;
  	parsed_hba_lines = new_parsed_lines;
  
--- 1876,1881 ----
***************
*** 2233,2237 **** load_ident(void)
  void
  hba_getauthmethod(hbaPort *port)
  {
! 	check_hba(port);
  }
--- 2278,2806 ----
  void
  hba_getauthmethod(hbaPort *port)
  {
! 	check_hba(port, NULL, NULL);
! }
! 
! /*
!  * Returns the Text Datum representation of authentication method
!  */
! static Datum
! getauthmethod(UserAuth auth_method)
! {
! 	Datum		result;
! 
! 	switch (auth_method)
! 	{
! 		case uaReject:
! 			result = CStringGetTextDatum("reject");
! 			break;
! 		case uaTrust:
! 			result = CStringGetTextDatum("trust");
! 			break;
! 		case uaIdent:
! 			result = CStringGetTextDatum("ident");
! 			break;
! 		case uaPassword:
! 			result = CStringGetTextDatum("password");
! 			break;
! 		case uaMD5:
! 			result = CStringGetTextDatum("md5");
! 			break;
! 		case uaGSS:
! 			result = CStringGetTextDatum("gss");
! 			break;
! 		case uaSSPI:
! 			result = CStringGetTextDatum("sspi");
! 			break;
! 		case uaPAM:
! 			result = CStringGetTextDatum("pam");
! 			break;
! 		case uaLDAP:
! 			result = CStringGetTextDatum("ldap");
! 			break;
! 		case uaCert:
! 			result = CStringGetTextDatum("cert");
! 			break;
! 		case uaRADIUS:
! 			result = CStringGetTextDatum("radius");
! 			break;
! 		case uaPeer:
! 			result = CStringGetTextDatum("peer");
! 			break;
! 		default:
! 			elog(ERROR, "unexpected authentication method in parsed HBA entry");
! 			break;
! 	}
! 
! 	return result;
! }
! 
! static void
! hba_add_jsonb_string_key(JsonbParseState **pstate, char *string_key)
! {
! 	JsonbValue	jb;
! 
! 	jb.type = jbvString;
! 	jb.val.string.len = strlen(string_key);
! 	jb.val.string.val = pstrdup(string_key);
! 	pushJsonbValue(pstate, WJB_KEY, &jb);
! }
! 
! static void
! hba_add_jsonb_bool_value(JsonbParseState **pstate, bool bool_val)
! {
! 	JsonbValue	jb;
! 
! 	jb.type = jbvBool;
! 	jb.val.boolean = bool_val;
! 
! 	pushJsonbValue(pstate, WJB_VALUE, &jb);
! }
! 
! static void
! hba_add_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val)
! {
! 	JsonbValue	jb;
! 	char		outputstr[64];
! 
! 	sprintf(outputstr, "%d", int32_val);
! 	jb.type = jbvNumeric;
! 	jb.val.numeric = DatumGetNumeric(DirectFunctionCall3(numeric_in, CStringGetDatum(outputstr), 0, -1));
! 
! 	pushJsonbValue(pstate, WJB_VALUE, &jb);
! }
! 
! static void
! hba_add_jsonb_string_value(JsonbParseState **pstate, char *string_value)
! {
! 	JsonbValue	jb;
! 
! 	jb.type = jbvString;
! 	jb.val.string.len = strlen(string_value);
! 	jb.val.string.val = pstrdup(string_value);
! 	pushJsonbValue(pstate, WJB_VALUE, &jb);
! }
! 
! static Jsonb *
! gethba_options(HbaLine *hba)
! {
! 	JsonbParseState *parseState = NULL;
! 	JsonbValue *result;
! 
! 	result = pushJsonbValue(&parseState, WJB_BEGIN_OBJECT, NULL);
! 
! 	if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
! 	{
! 		if (hba->include_realm)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "include_realm");
! 			hba_add_jsonb_bool_value(&parseState, true);
! 		}
! 
! 		if (hba->krb_realm)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "krb_realm");
! 			hba_add_jsonb_string_value(&parseState, hba->krb_realm);
! 		}
! 	}
! 
! 	if (hba->usermap)
! 	{
! 		hba_add_jsonb_string_key(&parseState, "map");
! 		hba_add_jsonb_string_value(&parseState, hba->usermap);
! 	}
! 
! 	if (hba->clientcert)
! 	{
! 		hba_add_jsonb_string_key(&parseState, "clientcert");
! 		hba_add_jsonb_bool_value(&parseState, true);
! 	}
! 
! 	if (hba->pamservice)
! 	{
! 		hba_add_jsonb_string_key(&parseState, "pamservice");
! 		hba_add_jsonb_string_value(&parseState, hba->pamservice);
! 	}
! 
! 	if (hba->auth_method == uaLDAP)
! 	{
! 		if (hba->ldapserver)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapserver");
! 			hba_add_jsonb_string_value(&parseState, hba->ldapserver);
! 		}
! 
! 		if (hba->ldapport)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapport");
! 			hba_add_jsonb_int32_value(&parseState, hba->ldapport);
! 		}
! 
! 		if (hba->ldaptls)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldaptls");
! 			hba_add_jsonb_bool_value(&parseState, true);
! 		}
! 
! 		if (hba->ldapprefix)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapprefix");
! 			hba_add_jsonb_string_value(&parseState, hba->ldapprefix);
! 		}
! 
! 		if (hba->ldapsuffix)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapsuffix");
! 			hba_add_jsonb_string_value(&parseState, hba->ldapsuffix);
! 		}
! 
! 		if (hba->ldapbasedn)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapbasedn");
! 			hba_add_jsonb_string_value(&parseState, hba->ldapbasedn);
! 		}
! 
! 		if (hba->ldapbinddn)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapbinddn");
! 			hba_add_jsonb_string_value(&parseState, hba->ldapbinddn);
! 		}
! 
! 		if (hba->ldapbindpasswd)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapbindpasswd");
! 			hba_add_jsonb_string_value(&parseState, hba->ldapbindpasswd);
! 		}
! 
! 		if (hba->ldapsearchattribute)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapsearchattribute");
! 			hba_add_jsonb_string_value(&parseState, hba->ldapsearchattribute);
! 		}
! 
! 		if (hba->ldapscope)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapscope");
! 			hba_add_jsonb_int32_value(&parseState, hba->ldapscope);
! 		}
! 	}
! 
! 	if (hba->auth_method == uaRADIUS)
! 	{
! 		if (hba->radiusserver)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "radiusserver");
! 			hba_add_jsonb_string_value(&parseState, hba->radiusserver);
! 		}
! 
! 		if (hba->radiussecret)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "radiussecret");
! 			hba_add_jsonb_string_value(&parseState, hba->radiussecret);
! 		}
! 
! 		if (hba->radiusidentifier)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "radiusidentifier");
! 			hba_add_jsonb_string_value(&parseState, hba->radiusidentifier);
! 		}
! 
! 		if (hba->radiusport)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "radiusport");
! 			hba_add_jsonb_int32_value(&parseState, hba->radiusport);
! 		}
! 	}
! 
! 	result = pushJsonbValue(&parseState, WJB_END_OBJECT, NULL);
! 	return JsonbValueToJsonb(result);
! }
! 
! static void
! fill_hbaline(HbaLine *hba, TupleDesc tupdesc, Tuplestorestate *tuple_store,
! 			 char *reason)
! {
! 	Datum		values[NUM_PG_HBA_CONF_ATTS];
! 	bool		nulls[NUM_PG_HBA_CONF_ATTS];
! 	ListCell   *dbcell;
! 	char		buffer[NI_MAXHOST];
! 	HeapTuple	tuple;
! 	int			index;
! 	MemoryContext old_cxt;
! 	MemoryContext pg_hba_tuple_context;
! 
! 	if (tupdesc == NULL || tuple_store == NULL)
! 		return;
! 
! 	index = 0;
! 	memset(values, 0, sizeof(values));
! 	memset(nulls, 0, sizeof(nulls));
! 
! 	pg_hba_tuple_context = AllocSetContextCreate(CurrentMemoryContext,
! 												 "pg_hba_lookup tuple cxt",
! 												 ALLOCSET_DEFAULT_MINSIZE,
! 												 ALLOCSET_DEFAULT_INITSIZE,
! 												 ALLOCSET_DEFAULT_MAXSIZE);
! 
! 	old_cxt = MemoryContextSwitchTo(pg_hba_tuple_context);
! 
! 	/* line_number */
! 	values[index] = Int32GetDatum(hba->linenumber);
! 
! 	/* mode */
! 	index++;
! 	if (reason == NULL)
! 		values[index] = CStringGetTextDatum("matched");
! 	else
! 		values[index] = CStringGetTextDatum("skipped");
! 
! 	/* type */
! 	index++;
! 	switch (hba->conntype)
! 	{
! 		case ctLocal:
! 			values[index] = CStringGetTextDatum("local");
! 			break;
! 		case ctHost:
! 			values[index] = CStringGetTextDatum("host");
! 			break;
! 		case ctHostSSL:
! 			values[index] = CStringGetTextDatum("hostssl");
! 			break;
! 		case ctHostNoSSL:
! 			values[index] = CStringGetTextDatum("hostnossl");
! 			break;
! 		default:
! 			elog(ERROR, "unexpected connection type in parsed HBA entry");
! 			break;
! 	}
! 
! 	/* database */
! 	index++;
! 	if (list_length(hba->databases) != 0)
! 	{
! 		List	   *names = NULL;
! 		HbaToken   *tok;
! 
! 		foreach(dbcell, hba->databases)
! 		{
! 			tok = lfirst(dbcell);
! 			names = lappend(names, tok->string);
! 		}
! 
! 		values[index] = PointerGetDatum(strlist_to_textarray(names));
! 	}
! 	else
! 		nulls[index] = true;
! 
! 	/* user */
! 	index++;
! 	if (list_length(hba->roles) != 0)
! 	{
! 		List	   *roles = NULL;
! 		HbaToken   *tok;
! 
! 		foreach(dbcell, hba->roles)
! 		{
! 			tok = lfirst(dbcell);
! 			roles = lappend(roles, tok->string);
! 		}
! 
! 		values[index] = PointerGetDatum(strlist_to_textarray(roles));
! 	}
! 	else
! 		nulls[index] = true;
! 
! 	/* address */
! 	index++;
! 	if (pg_getnameinfo_all(&hba->addr, sizeof(struct sockaddr_storage),
! 						   buffer, sizeof(buffer),
! 						   NULL, 0,
! 						   NI_NUMERICHOST) == 0)
! 	{
! 		clean_ipv6_addr(hba->addr.ss_family, buffer);
! 		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
! 	}
! 	else
! 		nulls[index] = true;
! 
! 	/* hostname */
! 	index++;
! 	if (hba->hostname)
! 		values[index] = CStringGetTextDatum(hba->hostname);
! 	else
! 		nulls[index] = true;
! 
! 	/* method */
! 	index++;
! 	values[index] = getauthmethod(hba->auth_method);
! 
! 	/* options */
! 	index++;
! 	values[index] = PointerGetDatum(gethba_options(hba));
! 
! 	/* reason */
! 	index++;
! 	if (reason)
! 		values[index] = CStringGetTextDatum(reason);
! 	else
! 		nulls[index] = true;
! 
! 	tuple = heap_form_tuple(tupdesc, values, nulls);
! 	tuplestore_puttuple(tuple_store, tuple);
! 
! 	MemoryContextSwitchTo(old_cxt);
! 	MemoryContextDelete(pg_hba_tuple_context);
! 	return;
! }
! 
! /*
!  * SQL-accessible SRF to return all the settings from the pg_hba.conf
!  * file.
!  */
! Datum
! pg_hba_lookup(PG_FUNCTION_ARGS)
! {
! 	hbaPort    *port;
! 	Tuplestorestate *tuple_store;
! 	TupleDesc	tupdesc;
! 	MemoryContext old_cxt;
! 
! 	/*
! 	 * We must use the Materialize mode to be safe against HBA file reloads
! 	 * while the cursor is open. It's also more efficient than having to look
! 	 * up our current position in the parsed list every time.
! 	 */
! 	ReturnSetInfo *rsi = (ReturnSetInfo *) fcinfo->resultinfo;
! 
! 	if (!superuser())
! 		ereport(ERROR,
! 				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
! 				 (errmsg("must be superuser to view pg_hba.conf settings"))));
! 
! 	if (!rsi || !IsA(rsi, ReturnSetInfo) ||
! 		(rsi->allowedModes & SFRM_Materialize) == 0)
! 		ereport(ERROR,
! 				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
! 				 errmsg("set-valued function called in context that "
! 						"cannot accept a set")));
! 
! 	port = palloc0(sizeof(hbaPort));
! 
! 	if (PG_ARGISNULL(0))
! 		ereport(ERROR,
! 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
! 				 (errmsg("database name is required to match pg_hba configuration entry"))));
! 	else
! 		port->database_name = TextDatumGetCString(PG_GETARG_DATUM(0));
! 
! 	if (PG_ARGISNULL(1))
! 		ereport(ERROR,
! 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
! 				 (errmsg("user name is required to match pg_hba configuration entry"))));
! 	else
! 		port->user_name = TextDatumGetCString(PG_GETARG_DATUM(1));
! 
! 
! 	if (!PG_ARGISNULL(2))
! 	{
! 		char	   *address = NULL;
! 		struct addrinfo *gai_result = NULL;
! 		struct addrinfo hints;
! 		int			ret;
! 
! 		address = TextDatumGetCString(PG_GETARG_DATUM(2));
! 
! 		/* Get the IP address either way */
! 		hints.ai_flags = AI_NUMERICHOST;
! 		hints.ai_family = AF_UNSPEC;
! 		hints.ai_socktype = 0;
! 		hints.ai_protocol = 0;
! 		hints.ai_addrlen = 0;
! 		hints.ai_canonname = NULL;
! 		hints.ai_addr = NULL;
! 		hints.ai_next = NULL;
! 
! 		ret = getaddrinfo(address, NULL, &hints, &gai_result);
! 		if (ret == 0 && gai_result)
! 			memcpy(&port->raddr.addr, gai_result->ai_addr, gai_result->ai_addrlen);
! 		else if (ret == EAI_NONAME)
! 		{
! 			struct addrinfo *gai_result2 = NULL;
! 
! 			port->remote_hostname = pstrdup(address);
! 
! 			ret = getaddrinfo(port->remote_hostname, NULL, NULL, &gai_result2);
! 			if (ret == 0 && gai_result2)
! 				memcpy(&port->raddr.addr, gai_result2->ai_addr, gai_result2->ai_addrlen);
! 			else
! 				ereport(ERROR,
! 				(errmsg("getaddrinfo failed to look into hostname \"%s\": %s",
! 						port->remote_hostname, gai_strerror(ret))));
! 
! 			if (gai_result2)
! 				freeaddrinfo(gai_result2);
! 		}
! 		else
! 			ereport(ERROR,
! 					(errmsg("invalid IP address \"%s\": %s",
! 							address, gai_strerror(ret))));
! 		if (gai_result)
! 			freeaddrinfo(gai_result);
! 	}
! 	else
! 		port->raddr.addr.ss_family = AF_UNIX;
! 
! 	port->ssl_in_use = DatumGetBool(PG_GETARG_DATUM(3));
! 
! 	rsi->returnMode = SFRM_Materialize;
! 
! 	if (!load_hba())
! 		ereport(ERROR,
! 			 (errmsg("There was some failure in loading pg_hba.conf file")));
! 
! 	/*
! 	 * Create the tupledesc and tuplestore in the per_query context as
! 	 * required for SFRM_Materialize.
! 	 */
! 	old_cxt = MemoryContextSwitchTo(rsi->econtext->ecxt_per_query_memory);
! 
! 	tupdesc = CreateTemplateTupleDesc(NUM_PG_HBA_CONF_ATTS, false);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 1, "line_number",
! 					   INT4OID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 2, "mode",
! 					   TEXTOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 3, "type",
! 					   TEXTOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 4, "database",
! 					   TEXTARRAYOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 5, "user_name",
! 					   TEXTARRAYOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 6, "address",
! 					   INETOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 7, "hostname",
! 					   TEXTOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 8, "method",
! 					   TEXTOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 9, "options",
! 					   JSONBOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 10, "reason",
! 					   TEXTOID, -1, 0);
! 	BlessTupleDesc(tupdesc);
! 
! 	tuple_store =
! 		tuplestore_begin_heap(rsi->allowedModes & SFRM_Materialize_Random,
! 							  false, work_mem);
! 
! 	MemoryContextSwitchTo(old_cxt);
! 
! 	check_hba(port, tupdesc, tuple_store);
! 
! 	rsi->setDesc = tupdesc;
! 	rsi->setResult = tuple_store;
! 
! 	MemoryContextDelete(parsed_hba_context);
! 	parsed_hba_context = NULL;
! 
! 	PG_RETURN_NULL();
  }
*** a/src/include/catalog/pg_proc.h
--- b/src/include/catalog/pg_proc.h
***************
*** 3079,3084 **** DATA(insert OID = 2084 (  pg_show_all_settings	PGNSP PGUID 12 1 1000 0 0 f f f f
--- 3079,3086 ----
  DESCR("SHOW ALL as a function");
  DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
  DESCR("show config file settings");
+ DATA(insert OID = 3997 (pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f f t v u 4 0 2249 "25 25 25 16" "{25,25,25,16,23,25,25,1009,1009,869,25,25,3802,25}" "{i,i,i,i,o,o,o,o,o,o,o,o,o,o}" "{database,user_name,address,ssl_inuse,line_number,mode,type,database,user_name,address,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+ DESCR("view client authentication settings");
  DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
  DESCR("view system lock information");
  DATA(insert OID = 1065 (  pg_prepared_xact PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{28,25,1184,26,26}" "{o,o,o,o,o}" "{transaction,gid,prepared,ownerid,dbid}" _null_ _null_ pg_prepared_xact _null_ _null_ _null_ ));
*** a/src/include/utils/builtins.h
--- b/src/include/utils/builtins.h
***************
*** 1123,1128 **** extern Datum set_config_by_name(PG_FUNCTION_ARGS);
--- 1123,1131 ----
  extern Datum show_all_settings(PG_FUNCTION_ARGS);
  extern Datum show_all_file_settings(PG_FUNCTION_ARGS);
  
+ /* hba.c */
+ extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
+ 
  /* rls.c */
  extern Datum row_security_active(PG_FUNCTION_ARGS);
  extern Datum row_security_active_name(PG_FUNCTION_ARGS);

From 56b584c25b952d6855d2a3d77eb40755d982efb9 Mon Sep 17 00:00:00 2001
From: Oleksandr Shulgin <oleksandr.shulgin@zalando.de>
Date: Tue, 29 Dec 2015 14:51:27 +0100
Subject: [PATCH] WIP: pg_hba_lookup()

---
 doc/src/sgml/func.sgml               |  39 +++
 src/backend/catalog/system_views.sql |   9 +
 src/backend/libpq/hba.c              | 663 ++++++++++++++++++++++++++++++++++-
 src/backend/utils/init/postinit.c    |  26 +-
 src/include/catalog/pg_proc.h        |   2 +
 src/include/libpq/hba.h              |   4 +
 src/include/utils/builtins.h         |   3 +
 7 files changed, 720 insertions(+), 26 deletions(-)

diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml
new file mode 100644
index e08bf60..2594dd5
*** a/doc/src/sgml/func.sgml
--- b/doc/src/sgml/func.sgml
*************** SELECT collation for ('foo' COLLATE "de_
*** 16576,16581 ****
--- 16576,16594 ----
         <entry><type>text</type></entry>
         <entry>set parameter and return new value</entry>
        </row>
+       <row>
+        <entry>
+         <indexterm>
+          <primary>pg_hba_lookup</primary>
+         </indexterm>
+         <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+                             <parameter>user_name</> <type>text</>
+                             [, <parameter>address</> <type>text</>]
+                             [, <parameter>ssl_inuse</> <type>text</>)</function></literal>
+        </entry>
+        <entry><type>record</type></entry>
+        <entry>scan <filename>pg_hba.conf</> and return examined entries up to a matching one</entry>
+       </row>
       </tbody>
      </tgroup>
     </table>
*************** SELECT set_config('log_statement_stats',
*** 16633,16638 ****
--- 16646,16677 ----
  </programlisting>
     </para>
  
+    <para>
+     <function>pg_hba_lookup</function> returns a set of records containing the
+     line number, mode, type, database, user_name, address, netmask, hostname,
+     method, options and skip reason. For example, to debug problems with user
+     <literal>kommih</> trying to connect to a database <literal>postgres</>
+     from IPv6-address <literal>::1</>, one can issue a following query:
+ <programlisting>
+ postgres=# SELECT * FROM pg_hba_lookup('postgres', 'kommih', '::1');
+  line_number |  mode   | type  | database | user_name |  address  |                 netmask                 | hostname | method | options |          reason          
+ -------------+---------+-------+----------+-----------+-----------+-----------------------------------------+----------+--------+---------+--------------------------
+           84 | skipped | local | {all}    | {all}     |           |                                         |          | trust  | {}      | connection type mismatch
+           86 | skipped | host  | {all}    | {all}     | 127.0.0.1 | 255.255.255.255                         |          | trust  | {}      | IP address mismatch
+           88 | matched | host  | {all}    | {all}     | ::1       | ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff |          | trust  | {}      | 
+ (3 rows)
+ 
+ </programlisting>
+     This function actually loads the contents of <filename>pg_hba.conf</> file
+     into memory to perform matching, thus a database administrator can use it
+     to test the effects of changes made to the file in isolation prior to
+     actually applying the configuration cluster-wide with a signal to the
+     postmaster process.
+ 
+     Only superusers can access this function to look the
+     <filename>pg_hba.conf</> entries up.
+    </para>
+    
    </sect2>
  
    <sect2 id="functions-admin-signal">
diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql
new file mode 100644
index 536c805..9ffc4fa
*** a/src/backend/catalog/system_views.sql
--- b/src/backend/catalog/system_views.sql
*************** RETURNS jsonb
*** 948,950 ****
--- 948,959 ----
  LANGUAGE INTERNAL
  STRICT IMMUTABLE
  AS 'jsonb_set';
+ 
+ CREATE OR REPLACE FUNCTION pg_hba_lookup(IN database text, IN user_name text,
+     IN address text DEFAULT NULL, IN ssl_inuse boolean DEFAULT false,
+ 	OUT line_number int, OUT mode text, OUT type text, OUT database text[],
+ 	OUT user_name text[], OUT address inet, OUT netmask inet,
+         OUT hostname text, OUT method text, OUT options jsonb, OUT reason text)
+ RETURNS SETOF RECORD
+ LANGUAGE INTERNAL
+ AS 'pg_hba_lookup';
diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
new file mode 100644
index 94f7cfa..09e819c
*** a/src/backend/libpq/hba.c
--- b/src/backend/libpq/hba.c
***************
*** 25,39 ****
--- 25,46 ----
  #include <arpa/inet.h>
  #include <unistd.h>
  
+ #include "access/htup_details.h"
+ #include "catalog/objectaddress.h"
  #include "catalog/pg_collation.h"
+ #include "catalog/pg_type.h"
+ #include "funcapi.h"
  #include "libpq/ip.h"
  #include "libpq/libpq.h"
+ #include "miscadmin.h"
  #include "postmaster/postmaster.h"
  #include "regex/regex.h"
  #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "utils/acl.h"
+ #include "utils/builtins.h"
  #include "utils/guc.h"
+ #include "utils/jsonb.h"
  #include "utils/lsyscache.h"
  #include "utils/memutils.h"
  
***************
*** 52,57 ****
--- 59,66 ----
  #define MAX_TOKEN	256
  #define MAX_LINE	8192
  
+ #define NUM_PG_HBA_LOOKUP_ATTS   11
+ 
  /* callback data for check_network_callback */
  typedef struct check_network_data
  {
*************** typedef struct HbaToken
*** 74,79 ****
--- 83,100 ----
  	bool		quoted;
  } HbaToken;
  
+ /* Optional callback function type for check_hba(). */
+ typedef void (*check_hba_line_callback)(void *context, HbaLine *hba_line,
+ 			  const char *reason);
+ 
+ /* Context to use with lookup_hba_line_callback(). */
+ typedef struct {
+ 	MemoryContext		memcxt;
+ 	TupleDesc			tupdesc;
+ 	Tuplestorestate	   *tuple_store;
+ } LookupHbalineContext;
+ 
+ 
  /*
   * pre-parsed content of HBA config file: list of HbaLine structs.
   * parsed_hba_context is the memory context where it lives.
*************** static List *tokenize_inc_file(List *tok
*** 99,104 ****
--- 120,132 ----
  				  const char *inc_filename);
  static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
  				   int line_num);
+ static Datum getauthmethod(UserAuth auth_method);
+ static void hba_add_jsonb_string_key(JsonbParseState **pstate, char *string_key);
+ static void hba_add_jsonb_bool_value(JsonbParseState **pstate, bool bool_val);
+ static void hba_add_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val);
+ static void hba_add_jsonb_string_value(JsonbParseState **pstate, char *string_value);
+ static Jsonb *gethba_options(HbaLine *hba);
+ static void lookup_hba_line_callback(void *context, HbaLine *hba, const char *reason);
  
  /*
   * isblank() exists in the ISO C99 spec, but it's not very portable yet,
*************** parse_hba_auth_opt(char *name, char *val
*** 1640,1646 ****
   *	request.
   */
  static void
! check_hba(hbaPort *port)
  {
  	Oid			roleid;
  	ListCell   *line;
--- 1668,1675 ----
   *	request.
   */
  static void
! check_hba(hbaPort *port, check_hba_line_callback callback,
! 		  void *callback_context)
  {
  	Oid			roleid;
  	ListCell   *line;
*************** check_hba(hbaPort *port)
*** 1657,1681 ****
--- 1686,1726 ----
  		if (hba->conntype == ctLocal)
  		{
  			if (!IS_AF_UNIX(port->raddr.addr.ss_family))
+ 			{
+ 				if (callback)
+ 					callback(callback_context, hba, "connection type mismatch");
  				continue;
+ 			}
  		}
  		else
  		{
  			if (IS_AF_UNIX(port->raddr.addr.ss_family))
+ 			{
+ 				if (callback)
+ 					callback(callback_context, hba, "connection type mismatch");
  				continue;
+ 			}
  
  			/* Check SSL state */
  			if (port->ssl_in_use)
  			{
  				/* Connection is SSL, match both "host" and "hostssl" */
  				if (hba->conntype == ctHostNoSSL)
+ 				{
+ 					if (callback)
+ 						callback(callback_context, hba, "connection type mismatch");
  					continue;
+ 				}
  			}
  			else
  			{
  				/* Connection is not SSL, match both "host" and "hostnossl" */
  				if (hba->conntype == ctHostSSL)
+ 				{
+ 					if (callback)
+ 						callback(callback_context, hba, "connection type mismatch");
  					continue;
+ 				}
  			}
  
  			/* Check IP address */
*************** check_hba(hbaPort *port)
*** 1686,1699 ****
--- 1731,1752 ----
  					{
  						if (!check_hostname(port,
  											hba->hostname))
+ 						{
+ 							if (callback)
+ 								callback(callback_context, hba, "hostname mismatch");
  							continue;
+ 						}
  					}
  					else
  					{
  						if (!check_ip(&port->raddr,
  									  (struct sockaddr *) & hba->addr,
  									  (struct sockaddr *) & hba->mask))
+ 						{
+ 							if (callback)
+ 								callback(callback_context, hba, "IP address mismatch");
  							continue;
+ 						}
  					}
  					break;
  				case ipCmpAll:
*************** check_hba(hbaPort *port)
*** 1702,1708 ****
--- 1755,1765 ----
  				case ipCmpSameNet:
  					if (!check_same_host_or_net(&port->raddr,
  												hba->ip_cmp_method))
+ 					{
+ 						if (callback)
+ 							callback(callback_context, hba, "samehost/samenet mismatch");
  						continue;
+ 					}
  					break;
  				default:
  					/* shouldn't get here, but deem it no-match if so */
*************** check_hba(hbaPort *port)
*** 1713,1722 ****
--- 1770,1790 ----
  		/* Check database and role */
  		if (!check_db(port->database_name, port->user_name, roleid,
  					  hba->databases))
+ 		{
+ 			if (callback)
+ 				callback(callback_context, hba, "database name mismatch");
  			continue;
+ 		}
  
  		if (!check_role(port->user_name, roleid, hba->roles))
+ 		{
+ 			if (callback)
+ 				callback(callback_context, hba, "user name mismatch");
  			continue;
+ 		}
+ 
+ 		if (callback)
+ 			callback(callback_context, hba, NULL);
  
  		/* Found a record that matched! */
  		port->hba = hba;
*************** load_hba(void)
*** 1770,1777 ****
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	Assert(PostmasterContext);
! 	hbacxt = AllocSetContextCreate(PostmasterContext,
  								   "hba parser context",
  								   ALLOCSET_DEFAULT_MINSIZE,
  								   ALLOCSET_DEFAULT_MINSIZE,
--- 1838,1844 ----
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	hbacxt = AllocSetContextCreate(CurrentMemoryContext,
  								   "hba parser context",
  								   ALLOCSET_DEFAULT_MINSIZE,
  								   ALLOCSET_DEFAULT_MINSIZE,
*************** load_hba(void)
*** 1829,1842 ****
  	}
  
  	/* Loaded new file successfully, replace the one we use */
! 	if (parsed_hba_context != NULL)
! 		MemoryContextDelete(parsed_hba_context);
  	parsed_hba_context = hbacxt;
  	parsed_hba_lines = new_parsed_lines;
  
  	return true;
  }
  
  /*
   * Parse one tokenised line from the ident config file and store the result in
   * an IdentLine structure, or NULL if parsing fails.
--- 1896,1921 ----
  	}
  
  	/* Loaded new file successfully, replace the one we use */
! 	discard_hba();
  	parsed_hba_context = hbacxt;
  	parsed_hba_lines = new_parsed_lines;
  
  	return true;
  }
  
+ 
+ void
+ discard_hba(void)
+ {
+ 	if (parsed_hba_context != NULL)
+ 	{
+ 		MemoryContextDelete(parsed_hba_context);
+ 		parsed_hba_context = NULL;
+ 		parsed_hba_lines = NIL;
+ 	}
+ }
+ 
+ 
  /*
   * Parse one tokenised line from the ident config file and store the result in
   * an IdentLine structure, or NULL if parsing fails.
*************** load_ident(void)
*** 2148,2155 ****
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	Assert(PostmasterContext);
! 	ident_context = AllocSetContextCreate(PostmasterContext,
  										  "ident parser context",
  										  ALLOCSET_DEFAULT_MINSIZE,
  										  ALLOCSET_DEFAULT_MINSIZE,
--- 2227,2233 ----
  	FreeFile(file);
  
  	/* Now parse all the lines */
! 	ident_context = AllocSetContextCreate(CurrentMemoryContext,
  										  "ident parser context",
  										  ALLOCSET_DEFAULT_MINSIZE,
  										  ALLOCSET_DEFAULT_MINSIZE,
*************** load_ident(void)
*** 2202,2207 ****
--- 2280,2296 ----
  	}
  
  	/* Loaded new file successfully, replace the one we use */
+ 	discard_ident();
+ 	parsed_ident_context = ident_context;
+ 	parsed_ident_lines = new_parsed_lines;
+ 
+ 	return true;
+ }
+ 
+ 
+ void
+ discard_ident(void)
+ {
  	if (parsed_ident_lines != NIL)
  	{
  		foreach(parsed_line_cell, parsed_ident_lines)
*************** load_ident(void)
*** 2210,2227 ****
  			if (newline->ident_user[0] == '/')
  				pg_regfree(&newline->re);
  		}
  	}
  	if (parsed_ident_context != NULL)
  		MemoryContextDelete(parsed_ident_context);
! 
! 	parsed_ident_context = ident_context;
! 	parsed_ident_lines = new_parsed_lines;
! 
! 	return true;
  }
  
  
- 
  /*
   *	Determine what authentication method should be used when accessing database
   *	"database" from frontend "raddr", user "user".  Return the method and
--- 2299,2314 ----
  			if (newline->ident_user[0] == '/')
  				pg_regfree(&newline->re);
  		}
+ 		parsed_ident_lines = NIL;
  	}
  	if (parsed_ident_context != NULL)
+ 	{
  		MemoryContextDelete(parsed_ident_context);
! 		parsed_ident_context = NULL;
! 	}
  }
  
  
  /*
   *	Determine what authentication method should be used when accessing database
   *	"database" from frontend "raddr", user "user".  Return the method and
*************** load_ident(void)
*** 2233,2237 ****
  void
  hba_getauthmethod(hbaPort *port)
  {
! 	check_hba(port);
  }
--- 2320,2872 ----
  void
  hba_getauthmethod(hbaPort *port)
  {
! 	check_hba(port, NULL, NULL);
! }
! 
! 
! /*
!  * Returns the Text Datum representation of authentication method
!  */
! static Datum
! getauthmethod(UserAuth auth_method)
! {
! 	Datum		result;
! 
! 	switch (auth_method)
! 	{
! 		case uaReject:
! 			result = CStringGetTextDatum("reject");
! 			break;
! 		case uaTrust:
! 			result = CStringGetTextDatum("trust");
! 			break;
! 		case uaIdent:
! 			result = CStringGetTextDatum("ident");
! 			break;
! 		case uaPassword:
! 			result = CStringGetTextDatum("password");
! 			break;
! 		case uaMD5:
! 			result = CStringGetTextDatum("md5");
! 			break;
! 		case uaGSS:
! 			result = CStringGetTextDatum("gss");
! 			break;
! 		case uaSSPI:
! 			result = CStringGetTextDatum("sspi");
! 			break;
! 		case uaPAM:
! 			result = CStringGetTextDatum("pam");
! 			break;
! 		case uaLDAP:
! 			result = CStringGetTextDatum("ldap");
! 			break;
! 		case uaCert:
! 			result = CStringGetTextDatum("cert");
! 			break;
! 		case uaRADIUS:
! 			result = CStringGetTextDatum("radius");
! 			break;
! 		case uaPeer:
! 			result = CStringGetTextDatum("peer");
! 			break;
! 		default:
! 			elog(ERROR, "unexpected authentication method in parsed HBA entry");
! 			break;
! 	}
! 
! 	return result;
! }
! 
! static void
! hba_add_jsonb_string_key(JsonbParseState **pstate, char *string_key)
! {
! 	JsonbValue	jb;
! 
! 	jb.type = jbvString;
! 	jb.val.string.len = strlen(string_key);
! 	jb.val.string.val = pstrdup(string_key);
! 	pushJsonbValue(pstate, WJB_KEY, &jb);
! }
! 
! static void
! hba_add_jsonb_bool_value(JsonbParseState **pstate, bool bool_val)
! {
! 	JsonbValue	jb;
! 
! 	jb.type = jbvBool;
! 	jb.val.boolean = bool_val;
! 
! 	pushJsonbValue(pstate, WJB_VALUE, &jb);
! }
! 
! static void
! hba_add_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val)
! {
! 	JsonbValue	jb;
! 	char		outputstr[64];
! 
! 	snprintf(outputstr, 64, "%d", int32_val);
! 	jb.type = jbvNumeric;
! 	jb.val.numeric = DatumGetNumeric(DirectFunctionCall3(numeric_in, CStringGetDatum(outputstr), 0, -1));
! 
! 	pushJsonbValue(pstate, WJB_VALUE, &jb);
! }
! 
! static void
! hba_add_jsonb_string_value(JsonbParseState **pstate, char *string_value)
! {
! 	JsonbValue	jb;
! 
! 	jb.type = jbvString;
! 	jb.val.string.len = strlen(string_value);
! 	jb.val.string.val = pstrdup(string_value);
! 	pushJsonbValue(pstate, WJB_VALUE, &jb);
! }
! 
! static Jsonb *
! gethba_options(HbaLine *hba)
! {
! 	JsonbParseState	   *parseState = NULL;
! 	JsonbValue		   *result;
! 
! 	result = pushJsonbValue(&parseState, WJB_BEGIN_OBJECT, NULL);
! 
! 	if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
! 	{
! 		if (hba->include_realm)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "include_realm");
! 			hba_add_jsonb_bool_value(&parseState, true);
! 		}
! 
! 		if (hba->krb_realm)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "krb_realm");
! 			hba_add_jsonb_string_value(&parseState, hba->krb_realm);
! 		}
! 	}
! 
! 	if (hba->usermap)
! 	{
! 		hba_add_jsonb_string_key(&parseState, "map");
! 		hba_add_jsonb_string_value(&parseState, hba->usermap);
! 	}
! 
! 	if (hba->clientcert)
! 	{
! 		hba_add_jsonb_string_key(&parseState, "clientcert");
! 		hba_add_jsonb_bool_value(&parseState, true);
! 	}
! 
! 	if (hba->pamservice)
! 	{
! 		hba_add_jsonb_string_key(&parseState, "pamservice");
! 		hba_add_jsonb_string_value(&parseState, hba->pamservice);
! 	}
! 
! 	if (hba->auth_method == uaLDAP)
! 	{
! 		if (hba->ldapserver)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapserver");
! 			hba_add_jsonb_string_value(&parseState, hba->ldapserver);
! 		}
! 
! 		if (hba->ldapport)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapport");
! 			hba_add_jsonb_int32_value(&parseState, hba->ldapport);
! 		}
! 
! 		if (hba->ldaptls)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldaptls");
! 			hba_add_jsonb_bool_value(&parseState, true);
! 		}
! 
! 		if (hba->ldapprefix)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapprefix");
! 			hba_add_jsonb_string_value(&parseState, hba->ldapprefix);
! 		}
! 
! 		if (hba->ldapsuffix)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapsuffix");
! 			hba_add_jsonb_string_value(&parseState, hba->ldapsuffix);
! 		}
! 
! 		if (hba->ldapbasedn)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapbasedn");
! 			hba_add_jsonb_string_value(&parseState, hba->ldapbasedn);
! 		}
! 
! 		if (hba->ldapbinddn)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapbinddn");
! 			hba_add_jsonb_string_value(&parseState, hba->ldapbinddn);
! 		}
! 
! 		if (hba->ldapbindpasswd)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapbindpasswd");
! 			hba_add_jsonb_string_value(&parseState, hba->ldapbindpasswd);
! 		}
! 
! 		if (hba->ldapsearchattribute)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapsearchattribute");
! 			hba_add_jsonb_string_value(&parseState, hba->ldapsearchattribute);
! 		}
! 
! 		if (hba->ldapscope)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "ldapscope");
! 			hba_add_jsonb_int32_value(&parseState, hba->ldapscope);
! 		}
! 	}
! 
! 	if (hba->auth_method == uaRADIUS)
! 	{
! 		if (hba->radiusserver)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "radiusserver");
! 			hba_add_jsonb_string_value(&parseState, hba->radiusserver);
! 		}
! 
! 		if (hba->radiussecret)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "radiussecret");
! 			hba_add_jsonb_string_value(&parseState, hba->radiussecret);
! 		}
! 
! 		if (hba->radiusidentifier)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "radiusidentifier");
! 			hba_add_jsonb_string_value(&parseState, hba->radiusidentifier);
! 		}
! 
! 		if (hba->radiusport)
! 		{
! 			hba_add_jsonb_string_key(&parseState, "radiusport");
! 			hba_add_jsonb_int32_value(&parseState, hba->radiusport);
! 		}
! 	}
! 
! 	result = pushJsonbValue(&parseState, WJB_END_OBJECT, NULL);
! 	return JsonbValueToJsonb(result);
! }
! 
! 
! static void
! lookup_hba_line_callback(void *context, HbaLine *hba, const char *reason)
! {
! 	Datum			values[NUM_PG_HBA_LOOKUP_ATTS];
! 	bool			nulls[NUM_PG_HBA_LOOKUP_ATTS];
! 	ListCell	   *dbcell;
! 	char			buffer[NI_MAXHOST];
! 	HeapTuple		tuple;
! 	int				index;
! 	MemoryContext	old_cxt;
! 	LookupHbalineContext   *mycxt;
! 
! 	mycxt = (LookupHbalineContext *) context;
! 
! 	index = 0;
! 	memset(values, 0, sizeof(values));
! 	memset(nulls, 0, sizeof(nulls));
! 
! 	old_cxt = MemoryContextSwitchTo(mycxt->memcxt);
! 
! 	/* line_number */
! 	values[index] = Int32GetDatum(hba->linenumber);
! 
! 	/* mode */
! 	index++;
! 	if (reason == NULL)
! 		values[index] = CStringGetTextDatum("matched");
! 	else
! 		values[index] = CStringGetTextDatum("skipped");
! 
! 	/* type */
! 	index++;
! 	switch (hba->conntype)
! 	{
! 		case ctLocal:
! 			values[index] = CStringGetTextDatum("local");
! 			break;
! 		case ctHost:
! 			values[index] = CStringGetTextDatum("host");
! 			break;
! 		case ctHostSSL:
! 			values[index] = CStringGetTextDatum("hostssl");
! 			break;
! 		case ctHostNoSSL:
! 			values[index] = CStringGetTextDatum("hostnossl");
! 			break;
! 		default:
! 			elog(ERROR, "unexpected connection type in parsed HBA entry");
! 			break;
! 	}
! 
! 	/* database */
! 	index++;
! 	if (list_length(hba->databases) != 0)
! 	{
! 		List	   *names = NULL;
! 		HbaToken   *tok;
! 
! 		foreach(dbcell, hba->databases)
! 		{
! 			tok = lfirst(dbcell);
! 			names = lappend(names,
! 							tok->quoted ? psprintf("\"%s\"", tok->string) : tok->string);
! 		}
! 
! 		values[index] = PointerGetDatum(strlist_to_textarray(names));
! 	}
! 	else
! 		nulls[index] = true;
! 
! 	/* user */
! 	index++;
! 	if (list_length(hba->roles) != 0)
! 	{
! 		List	   *roles = NULL;
! 		HbaToken   *tok;
! 
! 		foreach(dbcell, hba->roles)
! 		{
! 			tok = lfirst(dbcell);
! 			roles = lappend(roles,
! 							tok->quoted ? psprintf("\"%s\"", tok->string) : tok->string);
! 		}
! 
! 		values[index] = PointerGetDatum(strlist_to_textarray(roles));
! 	}
! 	else
! 		nulls[index] = true;
! 
! 	/* address */
! 	index++;
! 	if (pg_getnameinfo_all(&hba->addr, sizeof(struct sockaddr_storage),
! 						   buffer, sizeof(buffer),
! 						   NULL, 0,
! 						   NI_NUMERICHOST) == 0)
! 	{
! 		clean_ipv6_addr(hba->addr.ss_family, buffer);
! 		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
! 	}
! 	else
! 		nulls[index] = true;
! 
! 	/* netmask */
! 	index++;
! 	if (pg_getnameinfo_all(&hba->mask, sizeof(struct sockaddr_storage),
! 						   buffer, sizeof(buffer),
! 						   NULL, 0,
! 						   NI_NUMERICHOST) == 0)
! 	{
! 		clean_ipv6_addr(hba->mask.ss_family, buffer);
! 		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
! 	}
! 	else
! 		nulls[index] = true;
! 
! 	/* hostname */
! 	index++;
! 	if (hba->hostname)
! 		values[index] = CStringGetTextDatum(hba->hostname);
! 	else
! 		nulls[index] = true;
! 
! 	/* method */
! 	index++;
! 	values[index] = getauthmethod(hba->auth_method);
! 
! 	/* options */
! 	index++;
! 	values[index] = PointerGetDatum(gethba_options(hba));
! 
! 	/* reason */
! 	index++;
! 	if (reason)
! 		values[index] = CStringGetTextDatum(reason);
! 	else
! 		nulls[index] = true;
! 
! 	tuple = heap_form_tuple(mycxt->tupdesc, values, nulls);
! 	tuplestore_puttuple(mycxt->tuple_store, tuple);
! 
! 	MemoryContextSwitchTo(old_cxt);
! 	return;
! }
! 
! /*
!  * SQL-accessible SRF to return all the settings from the pg_hba.conf
!  * file.
!  */
! Datum
! pg_hba_lookup(PG_FUNCTION_ARGS)
! {
! 	hbaPort				   *port;
! 	Tuplestorestate		   *tuple_store;
! 	TupleDesc				tupdesc;
! 	MemoryContext			old_cxt;
! 	LookupHbalineContext   *mycxt;
! 	ReturnSetInfo		   *rsi;
! 
! 	if (!superuser())
! 		ereport(ERROR,
! 				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
! 				 (errmsg("must be superuser to view pg_hba.conf settings"))));
! 
! 	/*
! 	 * We must use the Materialize mode to be safe against HBA file reloads
! 	 * while the cursor is open. It's also more efficient than having to look
! 	 * up our current position in the parsed list every time.
! 	 */
! 	rsi = (ReturnSetInfo *) fcinfo->resultinfo;
! 
! 	if (!rsi || !IsA(rsi, ReturnSetInfo) ||
! 		(rsi->allowedModes & SFRM_Materialize) == 0)
! 		ereport(ERROR,
! 				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
! 				 errmsg("set-valued function called in context that cannot accept a set")));
! 
! 	port = palloc0(sizeof(hbaPort));
! 
! 	if (PG_ARGISNULL(0))
! 		ereport(ERROR,
! 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
! 				 (errmsg("database name is required to match pg_hba configuration entry"))));
! 	else
! 		port->database_name = TextDatumGetCString(PG_GETARG_DATUM(0));
! 
! 	if (PG_ARGISNULL(1))
! 		ereport(ERROR,
! 				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
! 				 (errmsg("user name is required to match pg_hba configuration entry"))));
! 	else
! 		port->user_name = TextDatumGetCString(PG_GETARG_DATUM(1));
! 
! 
! 	if (!PG_ARGISNULL(2))
! 	{
! 		char	   *address = NULL;
! 		struct addrinfo *gai_result = NULL;
! 		struct addrinfo hints;
! 		int			ret;
! 
! 		address = TextDatumGetCString(PG_GETARG_DATUM(2));
! 
! 		/* Get the IP address either way */
! 		hints.ai_flags = AI_NUMERICHOST;
! 		hints.ai_family = AF_UNSPEC;
! 		hints.ai_socktype = 0;
! 		hints.ai_protocol = 0;
! 		hints.ai_addrlen = 0;
! 		hints.ai_canonname = NULL;
! 		hints.ai_addr = NULL;
! 		hints.ai_next = NULL;
! 
! 		ret = getaddrinfo(address, NULL, &hints, &gai_result);
! 		if (ret == 0 && gai_result)
! 			memcpy(&port->raddr.addr, gai_result->ai_addr, gai_result->ai_addrlen);
! 		else if (ret == EAI_NONAME)
! 		{
! 			struct addrinfo *gai_result2 = NULL;
! 
! 			port->remote_hostname = pstrdup(address);
! 
! 			ret = getaddrinfo(port->remote_hostname, NULL, NULL, &gai_result2);
! 			if (ret == 0 && gai_result2)
! 				memcpy(&port->raddr.addr, gai_result2->ai_addr, gai_result2->ai_addrlen);
! 			else
! 				ereport(ERROR,
! 						(errmsg("getaddrinfo failed to look into hostname \"%s\": %s",
! 								port->remote_hostname, gai_strerror(ret))));
! 
! 			if (gai_result2)
! 				freeaddrinfo(gai_result2);
! 		}
! 		else
! 			ereport(ERROR,
! 					(errmsg("invalid IP address \"%s\": %s",
! 							address, gai_strerror(ret))));
! 		if (gai_result)
! 			freeaddrinfo(gai_result);
! 	}
! 	else
! 		port->raddr.addr.ss_family = AF_UNIX;
! 
! 	port->ssl_in_use = DatumGetBool(PG_GETARG_DATUM(3));
! 
! 	rsi->returnMode = SFRM_Materialize;
! 
! 	if (!load_hba())
! 		ereport(ERROR,
! 				(errmsg("Failed to load pg_hba.conf file"),
! 				 errhint("More details may be available in the server log.")));
! 
! 	/*
! 	 * Create the tupledesc and tuplestore in the per_query context as
! 	 * required for SFRM_Materialize.
! 	 */
! 	old_cxt = MemoryContextSwitchTo(rsi->econtext->ecxt_per_query_memory);
! 
! 	tupdesc = CreateTemplateTupleDesc(NUM_PG_HBA_LOOKUP_ATTS, false);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 1, "line_number",
! 					   INT4OID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 2, "mode",
! 					   TEXTOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 3, "type",
! 					   TEXTOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 4, "database",
! 					   TEXTARRAYOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 5, "user_name",
! 					   TEXTARRAYOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 6, "address",
! 					   INETOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 7, "netmask",
! 					   INETOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 8, "hostname",
! 					   TEXTOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 9, "method",
! 					   TEXTOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 10, "options",
! 					   JSONBOID, -1, 0);
! 	TupleDescInitEntry(tupdesc, (AttrNumber) 11, "reason",
! 					   TEXTOID, -1, 0);
! 	BlessTupleDesc(tupdesc);
! 
! 	tuple_store =
! 		tuplestore_begin_heap(rsi->allowedModes & SFRM_Materialize_Random,
! 							  false, work_mem);
! 
! 	MemoryContextSwitchTo(old_cxt);
! 
! 	mycxt = (LookupHbalineContext *) palloc(sizeof(LookupHbalineContext));
! 	mycxt->memcxt = AllocSetContextCreate(CurrentMemoryContext,
! 										  "pg_hba_lookup tuple cxt",
! 										  ALLOCSET_DEFAULT_MINSIZE,
! 										  ALLOCSET_DEFAULT_INITSIZE,
! 										  ALLOCSET_DEFAULT_MAXSIZE);
! 	mycxt->tupdesc = tupdesc;
! 	mycxt->tuple_store = tuple_store;
! 
! 	check_hba(port, lookup_hba_line_callback, mycxt);
! 
! 	MemoryContextDelete(mycxt->memcxt);
! 	pfree(mycxt);
! 
! 	/* Clean up the memory allocated by load_hba() explicitly. */
! 	discard_hba();
! 
! 	rsi->setDesc = tupdesc;
! 	rsi->setResult = tuple_store;
! 
! 	PG_RETURN_NULL();
  }
diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c
new file mode 100644
index 7b19714..12427b7
*** a/src/backend/utils/init/postinit.c
--- b/src/backend/utils/init/postinit.c
*************** PerformAuthentication(Port *port)
*** 191,208 ****
  	 * FIXME: [fork/exec] Ugh.  Is there a way around this overhead?
  	 */
  #ifdef EXEC_BACKEND
- 	/*
- 	 * load_hba() and load_ident() want to work within the PostmasterContext,
- 	 * so create that if it doesn't exist (which it won't).  We'll delete it
- 	 * again later, in PostgresMain.
- 	 */
- 	if (PostmasterContext == NULL)
- 		PostmasterContext = AllocSetContextCreate(TopMemoryContext,
- 												  "Postmaster",
- 												  ALLOCSET_DEFAULT_MINSIZE,
- 												  ALLOCSET_DEFAULT_INITSIZE,
- 												  ALLOCSET_DEFAULT_MAXSIZE);
- 
  	if (!load_hba())
  	{
  		/*
--- 191,196 ----
*************** PerformAuthentication(Port *port)
*** 241,246 ****
--- 229,240 ----
  	 */
  	disable_timeout(STATEMENT_TIMEOUT, false);
  
+ #ifdef EXEC_BACKEND
+ 	/* Discard the loaded HBA and ident files data explicitly. */
+ 	discard_hba();
+ 	discard_ident();
+ #endif
+ 
  	if (Log_connections)
  	{
  		if (am_walsender)
*************** InitPostgres(const char *in_dbname, Oid
*** 736,741 ****
--- 730,743 ----
  	}
  
  	/*
+ 	 * We don't need the HBA and ident data going forward, but we can't rely
+ 	 * on release of PostmasterContext to clean that up, so discard them
+ 	 * explicitly here.
+ 	 */
+ 	discard_hba();
+ 	discard_ident();
+ 
+ 	/*
  	 * If we're trying to shut down, only superusers can connect, and new
  	 * replication connections are not allowed.
  	 */
diff --git a/src/include/catalog/pg_proc.h b/src/include/catalog/pg_proc.h
new file mode 100644
index d8640db..ebd96da
*** a/src/include/catalog/pg_proc.h
--- b/src/include/catalog/pg_proc.h
*************** DATA(insert OID = 2084 (  pg_show_all_se
*** 3079,3084 ****
--- 3079,3086 ----
  DESCR("SHOW ALL as a function");
  DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
  DESCR("show config file settings");
+ DATA(insert OID = 3997 (  pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f f t v u 4 0 2249 "25 25 25 16" "{25,25,25,16,23,25,25,1009,1009,869,869,25,25,3802,25}" "{i,i,i,i,o,o,o,o,o,o,o,o,o,o,o}" "{database,user_name,address,ssl_inuse,line_number,mode,type,database,user_name,address,netmask,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+ DESCR("view client authentication settings");
  DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
  DESCR("view system lock information");
  DATA(insert OID = 1065 (  pg_prepared_xact PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{28,25,1184,26,26}" "{o,o,o,o,o}" "{transaction,gid,prepared,ownerid,dbid}" _null_ _null_ pg_prepared_xact _null_ _null_ _null_ ));
diff --git a/src/include/libpq/hba.h b/src/include/libpq/hba.h
new file mode 100644
index 68a953a..291300b
*** a/src/include/libpq/hba.h
--- b/src/include/libpq/hba.h
*************** typedef struct Port hbaPort;
*** 98,103 ****
--- 98,107 ----
  
  extern bool load_hba(void);
  extern bool load_ident(void);
+ 
+ extern void discard_hba(void);
+ extern void discard_ident(void);
+ 
  extern void hba_getauthmethod(hbaPort *port);
  extern int check_usermap(const char *usermap_name,
  			  const char *pg_role, const char *auth_user,
diff --git a/src/include/utils/builtins.h b/src/include/utils/builtins.h
new file mode 100644
index e610bf3..2d60879
*** a/src/include/utils/builtins.h
--- b/src/include/utils/builtins.h
*************** extern Datum set_config_by_name(PG_FUNCT
*** 1123,1128 ****
--- 1123,1131 ----
  extern Datum show_all_settings(PG_FUNCTION_ARGS);
  extern Datum show_all_file_settings(PG_FUNCTION_ARGS);
  
+ /* hba.c */
+ extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
+ 
  /* rls.c */
  extern Datum row_security_active(PG_FUNCTION_ARGS);
  extern Datum row_security_active_name(PG_FUNCTION_ARGS);
-- 
2.5.0

diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml
index 8ef9fce..215c7c0 100644
--- a/doc/src/sgml/func.sgml
+++ b/doc/src/sgml/func.sgml
@@ -16576,6 +16576,19 @@ SELECT collation for ('foo' COLLATE "de_DE");
        <entry><type>text</type></entry>
        <entry>set parameter and return new value</entry>
       </row>
+      <row>
+       <entry>
+        <indexterm>
+         <primary>pg_hba_lookup</primary>
+        </indexterm>
+        <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+                            <parameter>user_name</> <type>text</>
+                            [, <parameter>address</> <type>text</>]
+                            [, <parameter>ssl_inuse</> <type>text</>)</function></literal>
+       </entry>
+       <entry><type>record</type></entry>
+       <entry>scan <filename>pg_hba.conf</> and return examined entries up to a matching one</entry>
+      </row>
      </tbody>
     </tgroup>
    </table>
@@ -16633,6 +16646,32 @@ SELECT set_config('log_statement_stats', 'off', false);
 </programlisting>
    </para>
 
+   <para>
+    <function>pg_hba_lookup</function> returns a set of records containing the
+    line number, mode, type, database, user_name, address, netmask, hostname,
+    method, options and skip reason. For example, to debug problems with user
+    <literal>kommih</> trying to connect to a database <literal>postgres</>
+    from IPv6-address <literal>::1</>, one can issue a following query:
+<programlisting>
+postgres=# SELECT * FROM pg_hba_lookup('postgres', 'kommih', '::1');
+ line_number |  mode   | type  | database | user_name |  address  |                 netmask                 | hostname | method | options |          reason          
+-------------+---------+-------+----------+-----------+-----------+-----------------------------------------+----------+--------+---------+--------------------------
+          84 | skipped | local | {all}    | {all}     |           |                                         |          | trust  | {}      | connection type mismatch
+          86 | skipped | host  | {all}    | {all}     | 127.0.0.1 | 255.255.255.255                         |          | trust  | {}      | IP address mismatch
+          88 | matched | host  | {all}    | {all}     | ::1       | ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff |          | trust  | {}      | 
+(3 rows)
+
+</programlisting>
+    This function actually loads the contents of <filename>pg_hba.conf</> file
+    into memory to perform matching, thus a database administrator can use it
+    to test the effects of changes made to the file in isolation prior to
+    actually applying the configuration cluster-wide with a signal to the
+    postmaster process.
+
+    Only superusers can access this function to look the
+    <filename>pg_hba.conf</> entries up.
+   </para>
+   
   </sect2>
 
   <sect2 id="functions-admin-signal">
diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql
index 536c805..9ffc4fa 100644
--- a/src/backend/catalog/system_views.sql
+++ b/src/backend/catalog/system_views.sql
@@ -948,3 +948,12 @@ RETURNS jsonb
 LANGUAGE INTERNAL
 STRICT IMMUTABLE
 AS 'jsonb_set';
+
+CREATE OR REPLACE FUNCTION pg_hba_lookup(IN database text, IN user_name text,
+    IN address text DEFAULT NULL, IN ssl_inuse boolean DEFAULT false,
+	OUT line_number int, OUT mode text, OUT type text, OUT database text[],
+	OUT user_name text[], OUT address inet, OUT netmask inet,
+        OUT hostname text, OUT method text, OUT options jsonb, OUT reason text)
+RETURNS SETOF RECORD
+LANGUAGE INTERNAL
+AS 'pg_hba_lookup';
diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index 58a4565..fb1dbe7 100644
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -25,15 +25,22 @@
 #include <arpa/inet.h>
 #include <unistd.h>
 
+#include "access/htup_details.h"
+#include "catalog/objectaddress.h"
 #include "catalog/pg_collation.h"
+#include "catalog/pg_type.h"
+#include "funcapi.h"
 #include "libpq/ip.h"
 #include "libpq/libpq.h"
+#include "miscadmin.h"
 #include "postmaster/postmaster.h"
 #include "regex/regex.h"
 #include "replication/walsender.h"
 #include "storage/fd.h"
 #include "utils/acl.h"
+#include "utils/builtins.h"
 #include "utils/guc.h"
+#include "utils/jsonb.h"
 #include "utils/lsyscache.h"
 #include "utils/memutils.h"
 
@@ -52,6 +59,8 @@
 #define MAX_TOKEN	256
 #define MAX_LINE	8192
 
+#define NUM_PG_HBA_LOOKUP_ATTS   11
+
 /* callback data for check_network_callback */
 typedef struct check_network_data
 {
@@ -74,6 +83,18 @@ typedef struct HbaToken
 	bool		quoted;
 } HbaToken;
 
+/* Optional callback function type for check_hba(). */
+typedef void (*check_hba_line_callback)(void *context, HbaLine *hba_line,
+			  const char *reason);
+
+/* Context to use with lookup_hba_line_callback(). */
+typedef struct {
+	MemoryContext		memcxt;
+	TupleDesc			tupdesc;
+	Tuplestorestate	   *tuple_store;
+} LookupHbalineContext;
+
+
 /*
  * pre-parsed content of HBA config file: list of HbaLine structs.
  * parsed_hba_context is the memory context where it lives.
@@ -99,6 +120,13 @@ static List *tokenize_inc_file(List *tokens, const char *outer_filename,
 				  const char *inc_filename);
 static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
 				   int line_num);
+static Datum getauthmethod(UserAuth auth_method);
+static void hba_add_jsonb_string_key(JsonbParseState **pstate, char *string_key);
+static void hba_add_jsonb_bool_value(JsonbParseState **pstate, bool bool_val);
+static void hba_add_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val);
+static void hba_add_jsonb_string_value(JsonbParseState **pstate, char *string_value);
+static Jsonb *gethba_options(HbaLine *hba);
+static void lookup_hba_line_callback(void *context, HbaLine *hba, const char *reason);
 
 /*
  * isblank() exists in the ISO C99 spec, but it's not very portable yet,
@@ -1640,7 +1668,8 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num)
  *	request.
  */
 static void
-check_hba(hbaPort *port)
+check_hba(hbaPort *port, check_hba_line_callback callback,
+		  void *callback_context)
 {
 	Oid			roleid;
 	ListCell   *line;
@@ -1657,25 +1686,41 @@ check_hba(hbaPort *port)
 		if (hba->conntype == ctLocal)
 		{
 			if (!IS_AF_UNIX(port->raddr.addr.ss_family))
+			{
+				if (callback)
+					callback(callback_context, hba, "connection type mismatch");
 				continue;
+			}
 		}
 		else
 		{
 			if (IS_AF_UNIX(port->raddr.addr.ss_family))
+			{
+				if (callback)
+					callback(callback_context, hba, "connection type mismatch");
 				continue;
+			}
 
 			/* Check SSL state */
 			if (port->ssl_in_use)
 			{
 				/* Connection is SSL, match both "host" and "hostssl" */
 				if (hba->conntype == ctHostNoSSL)
+				{
+					if (callback)
+						callback(callback_context, hba, "connection type mismatch");
 					continue;
+				}
 			}
 			else
 			{
 				/* Connection is not SSL, match both "host" and "hostnossl" */
 				if (hba->conntype == ctHostSSL)
+				{
+					if (callback)
+						callback(callback_context, hba, "connection type mismatch");
 					continue;
+				}
 			}
 
 			/* Check IP address */
@@ -1686,14 +1731,22 @@ check_hba(hbaPort *port)
 					{
 						if (!check_hostname(port,
 											hba->hostname))
+						{
+							if (callback)
+								callback(callback_context, hba, "hostname mismatch");
 							continue;
+						}
 					}
 					else
 					{
 						if (!check_ip(&port->raddr,
 									  (struct sockaddr *) & hba->addr,
 									  (struct sockaddr *) & hba->mask))
+						{
+							if (callback)
+								callback(callback_context, hba, "IP address mismatch");
 							continue;
+						}
 					}
 					break;
 				case ipCmpAll:
@@ -1702,7 +1755,11 @@ check_hba(hbaPort *port)
 				case ipCmpSameNet:
 					if (!check_same_host_or_net(&port->raddr,
 												hba->ip_cmp_method))
+					{
+						if (callback)
+							callback(callback_context, hba, "samehost/samenet mismatch");
 						continue;
+					}
 					break;
 				default:
 					/* shouldn't get here, but deem it no-match if so */
@@ -1713,10 +1770,21 @@ check_hba(hbaPort *port)
 		/* Check database and role */
 		if (!check_db(port->database_name, port->user_name, roleid,
 					  hba->databases))
+		{
+			if (callback)
+				callback(callback_context, hba, "database name mismatch");
 			continue;
+		}
 
 		if (!check_role(port->user_name, roleid, hba->roles))
+		{
+			if (callback)
+				callback(callback_context, hba, "user name mismatch");
 			continue;
+		}
+
+		if (callback)
+			callback(callback_context, hba, NULL);
 
 		/* Found a record that matched! */
 		port->hba = hba;
@@ -2256,5 +2324,551 @@ discard_ident(void)
 void
 hba_getauthmethod(hbaPort *port)
 {
-	check_hba(port);
+	check_hba(port, NULL, NULL);
+}
+
+
+/*
+ * Returns the Text Datum representation of authentication method
+ */
+static Datum
+getauthmethod(UserAuth auth_method)
+{
+	Datum		result;
+
+	switch (auth_method)
+	{
+		case uaReject:
+			result = CStringGetTextDatum("reject");
+			break;
+		case uaTrust:
+			result = CStringGetTextDatum("trust");
+			break;
+		case uaIdent:
+			result = CStringGetTextDatum("ident");
+			break;
+		case uaPassword:
+			result = CStringGetTextDatum("password");
+			break;
+		case uaMD5:
+			result = CStringGetTextDatum("md5");
+			break;
+		case uaGSS:
+			result = CStringGetTextDatum("gss");
+			break;
+		case uaSSPI:
+			result = CStringGetTextDatum("sspi");
+			break;
+		case uaPAM:
+			result = CStringGetTextDatum("pam");
+			break;
+		case uaLDAP:
+			result = CStringGetTextDatum("ldap");
+			break;
+		case uaCert:
+			result = CStringGetTextDatum("cert");
+			break;
+		case uaRADIUS:
+			result = CStringGetTextDatum("radius");
+			break;
+		case uaPeer:
+			result = CStringGetTextDatum("peer");
+			break;
+		default:
+			elog(ERROR, "unexpected authentication method in parsed HBA entry");
+			break;
+	}
+
+	return result;
+}
+
+static void
+hba_add_jsonb_string_key(JsonbParseState **pstate, char *string_key)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvString;
+	jb.val.string.len = strlen(string_key);
+	jb.val.string.val = pstrdup(string_key);
+	pushJsonbValue(pstate, WJB_KEY, &jb);
+}
+
+static void
+hba_add_jsonb_bool_value(JsonbParseState **pstate, bool bool_val)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvBool;
+	jb.val.boolean = bool_val;
+
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
+
+static void
+hba_add_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val)
+{
+	JsonbValue	jb;
+	char		outputstr[64];
+
+	snprintf(outputstr, 64, "%d", int32_val);
+	jb.type = jbvNumeric;
+	jb.val.numeric = DatumGetNumeric(DirectFunctionCall3(numeric_in, CStringGetDatum(outputstr), 0, -1));
+
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
+
+static void
+hba_add_jsonb_string_value(JsonbParseState **pstate, char *string_value)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvString;
+	jb.val.string.len = strlen(string_value);
+	jb.val.string.val = pstrdup(string_value);
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
+
+static Jsonb *
+gethba_options(HbaLine *hba)
+{
+	JsonbParseState	   *parseState = NULL;
+	JsonbValue		   *result;
+
+	result = pushJsonbValue(&parseState, WJB_BEGIN_OBJECT, NULL);
+
+	if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
+	{
+		if (hba->include_realm)
+		{
+			hba_add_jsonb_string_key(&parseState, "include_realm");
+			hba_add_jsonb_bool_value(&parseState, true);
+		}
+
+		if (hba->krb_realm)
+		{
+			hba_add_jsonb_string_key(&parseState, "krb_realm");
+			hba_add_jsonb_string_value(&parseState, hba->krb_realm);
+		}
+	}
+
+	if (hba->usermap)
+	{
+		hba_add_jsonb_string_key(&parseState, "map");
+		hba_add_jsonb_string_value(&parseState, hba->usermap);
+	}
+
+	if (hba->clientcert)
+	{
+		hba_add_jsonb_string_key(&parseState, "clientcert");
+		hba_add_jsonb_bool_value(&parseState, true);
+	}
+
+	if (hba->pamservice)
+	{
+		hba_add_jsonb_string_key(&parseState, "pamservice");
+		hba_add_jsonb_string_value(&parseState, hba->pamservice);
+	}
+
+	if (hba->auth_method == uaLDAP)
+	{
+		if (hba->ldapserver)
+		{
+			hba_add_jsonb_string_key(&parseState, "ldapserver");
+			hba_add_jsonb_string_value(&parseState, hba->ldapserver);
+		}
+
+		if (hba->ldapport)
+		{
+			hba_add_jsonb_string_key(&parseState, "ldapport");
+			hba_add_jsonb_int32_value(&parseState, hba->ldapport);
+		}
+
+		if (hba->ldaptls)
+		{
+			hba_add_jsonb_string_key(&parseState, "ldaptls");
+			hba_add_jsonb_bool_value(&parseState, true);
+		}
+
+		if (hba->ldapprefix)
+		{
+			hba_add_jsonb_string_key(&parseState, "ldapprefix");
+			hba_add_jsonb_string_value(&parseState, hba->ldapprefix);
+		}
+
+		if (hba->ldapsuffix)
+		{
+			hba_add_jsonb_string_key(&parseState, "ldapsuffix");
+			hba_add_jsonb_string_value(&parseState, hba->ldapsuffix);
+		}
+
+		if (hba->ldapbasedn)
+		{
+			hba_add_jsonb_string_key(&parseState, "ldapbasedn");
+			hba_add_jsonb_string_value(&parseState, hba->ldapbasedn);
+		}
+
+		if (hba->ldapbinddn)
+		{
+			hba_add_jsonb_string_key(&parseState, "ldapbinddn");
+			hba_add_jsonb_string_value(&parseState, hba->ldapbinddn);
+		}
+
+		if (hba->ldapbindpasswd)
+		{
+			hba_add_jsonb_string_key(&parseState, "ldapbindpasswd");
+			hba_add_jsonb_string_value(&parseState, hba->ldapbindpasswd);
+		}
+
+		if (hba->ldapsearchattribute)
+		{
+			hba_add_jsonb_string_key(&parseState, "ldapsearchattribute");
+			hba_add_jsonb_string_value(&parseState, hba->ldapsearchattribute);
+		}
+
+		if (hba->ldapscope)
+		{
+			hba_add_jsonb_string_key(&parseState, "ldapscope");
+			hba_add_jsonb_int32_value(&parseState, hba->ldapscope);
+		}
+	}
+
+	if (hba->auth_method == uaRADIUS)
+	{
+		if (hba->radiusserver)
+		{
+			hba_add_jsonb_string_key(&parseState, "radiusserver");
+			hba_add_jsonb_string_value(&parseState, hba->radiusserver);
+		}
+
+		if (hba->radiussecret)
+		{
+			hba_add_jsonb_string_key(&parseState, "radiussecret");
+			hba_add_jsonb_string_value(&parseState, hba->radiussecret);
+		}
+
+		if (hba->radiusidentifier)
+		{
+			hba_add_jsonb_string_key(&parseState, "radiusidentifier");
+			hba_add_jsonb_string_value(&parseState, hba->radiusidentifier);
+		}
+
+		if (hba->radiusport)
+		{
+			hba_add_jsonb_string_key(&parseState, "radiusport");
+			hba_add_jsonb_int32_value(&parseState, hba->radiusport);
+		}
+	}
+
+	result = pushJsonbValue(&parseState, WJB_END_OBJECT, NULL);
+	return JsonbValueToJsonb(result);
+}
+
+
+static void
+lookup_hba_line_callback(void *context, HbaLine *hba, const char *reason)
+{
+	Datum			values[NUM_PG_HBA_LOOKUP_ATTS];
+	bool			nulls[NUM_PG_HBA_LOOKUP_ATTS];
+	ListCell	   *dbcell;
+	char			buffer[NI_MAXHOST];
+	HeapTuple		tuple;
+	int				index;
+	MemoryContext	old_cxt;
+	LookupHbalineContext   *mycxt;
+
+	mycxt = (LookupHbalineContext *) context;
+
+	index = 0;
+	memset(values, 0, sizeof(values));
+	memset(nulls, 0, sizeof(nulls));
+
+	old_cxt = MemoryContextSwitchTo(mycxt->memcxt);
+
+	/* line_number */
+	values[index] = Int32GetDatum(hba->linenumber);
+
+	/* mode */
+	index++;
+	if (reason == NULL)
+		values[index] = CStringGetTextDatum("matched");
+	else
+		values[index] = CStringGetTextDatum("skipped");
+
+	/* type */
+	index++;
+	switch (hba->conntype)
+	{
+		case ctLocal:
+			values[index] = CStringGetTextDatum("local");
+			break;
+		case ctHost:
+			values[index] = CStringGetTextDatum("host");
+			break;
+		case ctHostSSL:
+			values[index] = CStringGetTextDatum("hostssl");
+			break;
+		case ctHostNoSSL:
+			values[index] = CStringGetTextDatum("hostnossl");
+			break;
+		default:
+			elog(ERROR, "unexpected connection type in parsed HBA entry");
+			break;
+	}
+
+	/* database */
+	index++;
+	if (list_length(hba->databases) != 0)
+	{
+		List	   *names = NULL;
+		HbaToken   *tok;
+
+		foreach(dbcell, hba->databases)
+		{
+			tok = lfirst(dbcell);
+			names = lappend(names, tok->string);
+		}
+
+		values[index] = PointerGetDatum(strlist_to_textarray(names));
+	}
+	else
+		nulls[index] = true;
+
+	/* user */
+	index++;
+	if (list_length(hba->roles) != 0)
+	{
+		List	   *roles = NULL;
+		HbaToken   *tok;
+
+		foreach(dbcell, hba->roles)
+		{
+			tok = lfirst(dbcell);
+			roles = lappend(roles, tok->string);
+		}
+
+		values[index] = PointerGetDatum(strlist_to_textarray(roles));
+	}
+	else
+		nulls[index] = true;
+
+	/* address */
+	index++;
+	if (pg_getnameinfo_all(&hba->addr, sizeof(struct sockaddr_storage),
+						   buffer, sizeof(buffer),
+						   NULL, 0,
+						   NI_NUMERICHOST) == 0)
+	{
+		clean_ipv6_addr(hba->addr.ss_family, buffer);
+		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+	}
+	else
+		nulls[index] = true;
+
+	/* netmask */
+	index++;
+	if (pg_getnameinfo_all(&hba->mask, sizeof(struct sockaddr_storage),
+						   buffer, sizeof(buffer),
+						   NULL, 0,
+						   NI_NUMERICHOST) == 0)
+	{
+		clean_ipv6_addr(hba->mask.ss_family, buffer);
+		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+	}
+	else
+		nulls[index] = true;
+
+	/* hostname */
+	index++;
+	if (hba->hostname)
+		values[index] = CStringGetTextDatum(hba->hostname);
+	else
+		nulls[index] = true;
+
+	/* method */
+	index++;
+	values[index] = getauthmethod(hba->auth_method);
+
+	/* options */
+	index++;
+	values[index] = PointerGetDatum(gethba_options(hba));
+
+	/* reason */
+	index++;
+	if (reason)
+		values[index] = CStringGetTextDatum(reason);
+	else
+		nulls[index] = true;
+
+	tuple = heap_form_tuple(mycxt->tupdesc, values, nulls);
+	tuplestore_puttuple(mycxt->tuple_store, tuple);
+
+	MemoryContextSwitchTo(old_cxt);
+	return;
+}
+
+/*
+ * SQL-accessible SRF to return all the settings from the pg_hba.conf
+ * file.
+ */
+Datum
+pg_hba_lookup(PG_FUNCTION_ARGS)
+{
+	hbaPort				   *port;
+	Tuplestorestate		   *tuple_store;
+	TupleDesc				tupdesc;
+	MemoryContext			old_cxt;
+	LookupHbalineContext   *mycxt;
+	ReturnSetInfo		   *rsi;
+
+	if (!superuser())
+		ereport(ERROR,
+				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+				 (errmsg("must be superuser to view pg_hba.conf settings"))));
+
+	/*
+	 * We must use the Materialize mode to be safe against HBA file reloads
+	 * while the cursor is open. It's also more efficient than having to look
+	 * up our current position in the parsed list every time.
+	 */
+	rsi = (ReturnSetInfo *) fcinfo->resultinfo;
+
+	if (!rsi || !IsA(rsi, ReturnSetInfo) ||
+		(rsi->allowedModes & SFRM_Materialize) == 0)
+		ereport(ERROR,
+				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+				 errmsg("set-valued function called in context that cannot accept a set")));
+
+	port = palloc0(sizeof(hbaPort));
+
+	if (PG_ARGISNULL(0))
+		ereport(ERROR,
+				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+				 (errmsg("database name is required to match pg_hba configuration entry"))));
+	else
+		port->database_name = TextDatumGetCString(PG_GETARG_DATUM(0));
+
+	if (PG_ARGISNULL(1))
+		ereport(ERROR,
+				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+				 (errmsg("user name is required to match pg_hba configuration entry"))));
+	else
+		port->user_name = TextDatumGetCString(PG_GETARG_DATUM(1));
+
+
+	if (!PG_ARGISNULL(2))
+	{
+		char	   *address = NULL;
+		struct addrinfo *gai_result = NULL;
+		struct addrinfo hints;
+		int			ret;
+
+		address = TextDatumGetCString(PG_GETARG_DATUM(2));
+
+		/* Get the IP address either way */
+		hints.ai_flags = AI_NUMERICHOST;
+		hints.ai_family = AF_UNSPEC;
+		hints.ai_socktype = 0;
+		hints.ai_protocol = 0;
+		hints.ai_addrlen = 0;
+		hints.ai_canonname = NULL;
+		hints.ai_addr = NULL;
+		hints.ai_next = NULL;
+
+		ret = getaddrinfo(address, NULL, &hints, &gai_result);
+		if (ret == 0 && gai_result)
+			memcpy(&port->raddr.addr, gai_result->ai_addr, gai_result->ai_addrlen);
+		else if (ret == EAI_NONAME)
+		{
+			struct addrinfo *gai_result2 = NULL;
+
+			port->remote_hostname = pstrdup(address);
+
+			ret = getaddrinfo(port->remote_hostname, NULL, NULL, &gai_result2);
+			if (ret == 0 && gai_result2)
+				memcpy(&port->raddr.addr, gai_result2->ai_addr, gai_result2->ai_addrlen);
+			else
+				ereport(ERROR,
+						(errmsg("getaddrinfo failed to look into hostname \"%s\": %s",
+								port->remote_hostname, gai_strerror(ret))));
+
+			if (gai_result2)
+				freeaddrinfo(gai_result2);
+		}
+		else
+			ereport(ERROR,
+					(errmsg("invalid IP address \"%s\": %s",
+							address, gai_strerror(ret))));
+		if (gai_result)
+			freeaddrinfo(gai_result);
+	}
+	else
+		port->raddr.addr.ss_family = AF_UNIX;
+
+	port->ssl_in_use = DatumGetBool(PG_GETARG_DATUM(3));
+
+	rsi->returnMode = SFRM_Materialize;
+
+	if (!load_hba())
+		ereport(ERROR,
+				(errmsg("Failed to load pg_hba.conf file"),
+				 errhint("More details may be available in the server log.")));
+
+	/*
+	 * Create the tupledesc and tuplestore in the per_query context as
+	 * required for SFRM_Materialize.
+	 */
+	old_cxt = MemoryContextSwitchTo(rsi->econtext->ecxt_per_query_memory);
+
+	tupdesc = CreateTemplateTupleDesc(NUM_PG_HBA_LOOKUP_ATTS, false);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 1, "line_number",
+					   INT4OID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 2, "mode",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 3, "type",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 4, "database",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 5, "user_name",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 6, "address",
+					   INETOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 7, "netmask",
+					   INETOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 8, "hostname",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 9, "method",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 10, "options",
+					   JSONBOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 11, "reason",
+					   TEXTOID, -1, 0);
+	BlessTupleDesc(tupdesc);
+
+	tuple_store =
+		tuplestore_begin_heap(rsi->allowedModes & SFRM_Materialize_Random,
+							  false, work_mem);
+
+	MemoryContextSwitchTo(old_cxt);
+
+	mycxt = (LookupHbalineContext *) palloc(sizeof(LookupHbalineContext));
+	mycxt->memcxt = AllocSetContextCreate(CurrentMemoryContext,
+										  "pg_hba_lookup tuple cxt",
+										  ALLOCSET_DEFAULT_MINSIZE,
+										  ALLOCSET_DEFAULT_INITSIZE,
+										  ALLOCSET_DEFAULT_MAXSIZE);
+	mycxt->tupdesc = tupdesc;
+	mycxt->tuple_store = tuple_store;
+
+	check_hba(port, lookup_hba_line_callback, mycxt);
+
+	MemoryContextDelete(mycxt->memcxt);
+	pfree(mycxt);
+
+	/* Clean up the memory allocated by load_hba() explicitly. */
+	discard_hba();
+
+	rsi->setDesc = tupdesc;
+	rsi->setResult = tuple_store;
+
+	PG_RETURN_NULL();
 }
diff --git a/src/include/catalog/pg_proc.h b/src/include/catalog/pg_proc.h
index d8640db..ebd96da 100644
--- a/src/include/catalog/pg_proc.h
+++ b/src/include/catalog/pg_proc.h
@@ -3079,6 +3079,8 @@ DATA(insert OID = 2084 (  pg_show_all_settings	PGNSP PGUID 12 1 1000 0 0 f f f f
 DESCR("SHOW ALL as a function");
 DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
 DESCR("show config file settings");
+DATA(insert OID = 3997 (  pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f f t v u 4 0 2249 "25 25 25 16" "{25,25,25,16,23,25,25,1009,1009,869,869,25,25,3802,25}" "{i,i,i,i,o,o,o,o,o,o,o,o,o,o,o}" "{database,user_name,address,ssl_inuse,line_number,mode,type,database,user_name,address,netmask,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+DESCR("view client authentication settings");
 DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
 DESCR("view system lock information");
 DATA(insert OID = 1065 (  pg_prepared_xact PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{28,25,1184,26,26}" "{o,o,o,o,o}" "{transaction,gid,prepared,ownerid,dbid}" _null_ _null_ pg_prepared_xact _null_ _null_ _null_ ));
diff --git a/src/include/utils/builtins.h b/src/include/utils/builtins.h
index e610bf3..2d60879 100644
--- a/src/include/utils/builtins.h
+++ b/src/include/utils/builtins.h
@@ -1123,6 +1123,9 @@ extern Datum set_config_by_name(PG_FUNCTION_ARGS);
 extern Datum show_all_settings(PG_FUNCTION_ARGS);
 extern Datum show_all_file_settings(PG_FUNCTION_ARGS);
 
+/* hba.c */
+extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
+
 /* rls.c */
 extern Datum row_security_active(PG_FUNCTION_ARGS);
 extern Datum row_security_active_name(PG_FUNCTION_ARGS);

diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index 94f7cfa..58a4565 100644
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -1770,8 +1770,7 @@ load_hba(void)
 	FreeFile(file);
 
 	/* Now parse all the lines */
-	Assert(PostmasterContext);
-	hbacxt = AllocSetContextCreate(PostmasterContext,
+	hbacxt = AllocSetContextCreate(CurrentMemoryContext,
 								   "hba parser context",
 								   ALLOCSET_DEFAULT_MINSIZE,
 								   ALLOCSET_DEFAULT_MINSIZE,
@@ -1829,14 +1828,26 @@ load_hba(void)
 	}
 
 	/* Loaded new file successfully, replace the one we use */
-	if (parsed_hba_context != NULL)
-		MemoryContextDelete(parsed_hba_context);
+	discard_hba();
 	parsed_hba_context = hbacxt;
 	parsed_hba_lines = new_parsed_lines;
 
 	return true;
 }
 
+
+void
+discard_hba(void)
+{
+	if (parsed_hba_context != NULL)
+	{
+		MemoryContextDelete(parsed_hba_context);
+		parsed_hba_context = NULL;
+		parsed_hba_lines = NIL;
+	}
+}
+
+
 /*
  * Parse one tokenised line from the ident config file and store the result in
  * an IdentLine structure, or NULL if parsing fails.
@@ -2148,8 +2159,7 @@ load_ident(void)
 	FreeFile(file);
 
 	/* Now parse all the lines */
-	Assert(PostmasterContext);
-	ident_context = AllocSetContextCreate(PostmasterContext,
+	ident_context = AllocSetContextCreate(CurrentMemoryContext,
 										  "ident parser context",
 										  ALLOCSET_DEFAULT_MINSIZE,
 										  ALLOCSET_DEFAULT_MINSIZE,
@@ -2202,6 +2212,20 @@ load_ident(void)
 	}
 
 	/* Loaded new file successfully, replace the one we use */
+	discard_ident();
+	parsed_ident_context = ident_context;
+	parsed_ident_lines = new_parsed_lines;
+
+	return true;
+}
+
+
+void
+discard_ident(void)
+{
+	ListCell   *parsed_line_cell;
+	IdentLine  *newline;
+
 	if (parsed_ident_lines != NIL)
 	{
 		foreach(parsed_line_cell, parsed_ident_lines)
@@ -2210,18 +2234,17 @@ load_ident(void)
 			if (newline->ident_user[0] == '/')
 				pg_regfree(&newline->re);
 		}
+		parsed_ident_lines = NIL;
 	}
+
 	if (parsed_ident_context != NULL)
+	{
 		MemoryContextDelete(parsed_ident_context);
-
-	parsed_ident_context = ident_context;
-	parsed_ident_lines = new_parsed_lines;
-
-	return true;
+		parsed_ident_context = NULL;
+	}
 }
 
 
-
 /*
  *	Determine what authentication method should be used when accessing database
  *	"database" from frontend "raddr", user "user".  Return the method and
diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c
index 7b19714..073b432 100644
--- a/src/backend/utils/init/postinit.c
+++ b/src/backend/utils/init/postinit.c
@@ -191,18 +191,6 @@ PerformAuthentication(Port *port)
 	 * FIXME: [fork/exec] Ugh.  Is there a way around this overhead?
 	 */
 #ifdef EXEC_BACKEND
-	/*
-	 * load_hba() and load_ident() want to work within the PostmasterContext,
-	 * so create that if it doesn't exist (which it won't).  We'll delete it
-	 * again later, in PostgresMain.
-	 */
-	if (PostmasterContext == NULL)
-		PostmasterContext = AllocSetContextCreate(TopMemoryContext,
-												  "Postmaster",
-												  ALLOCSET_DEFAULT_MINSIZE,
-												  ALLOCSET_DEFAULT_INITSIZE,
-												  ALLOCSET_DEFAULT_MAXSIZE);
-
 	if (!load_hba())
 	{
 		/*
@@ -736,6 +724,14 @@ InitPostgres(const char *in_dbname, Oid dboid, const char *username,
 	}
 
 	/*
+	 * We don't need the HBA and ident data going forward, but we can't rely
+	 * on release of PostmasterContext to clean that up, so discard them
+	 * explicitly here.
+	 */
+	discard_hba();
+	discard_ident();
+
+	/*
 	 * If we're trying to shut down, only superusers can connect, and new
 	 * replication connections are not allowed.
 	 */
diff --git a/src/include/libpq/hba.h b/src/include/libpq/hba.h
index 68a953a..291300b 100644
--- a/src/include/libpq/hba.h
+++ b/src/include/libpq/hba.h
@@ -98,6 +98,10 @@ typedef struct Port hbaPort;
 
 extern bool load_hba(void);
 extern bool load_ident(void);
+
+extern void discard_hba(void);
+extern void discard_ident(void);
+
 extern void hba_getauthmethod(hbaPort *port);
 extern int check_usermap(const char *usermap_name,
 			  const char *pg_role, const char *auth_user,

diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml
index 139aa2b..977e5a0 100644
--- a/doc/src/sgml/func.sgml
+++ b/doc/src/sgml/func.sgml
@@ -16679,6 +16679,19 @@ SELECT collation for ('foo' COLLATE "de_DE");
        <entry><type>text</type></entry>
        <entry>set parameter and return new value</entry>
       </row>
+      <row>
+       <entry>
+        <indexterm>
+         <primary>pg_hba_lookup</primary>
+        </indexterm>
+        <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+                            <parameter>user_name</> <type>text</>
+                            [, <parameter>address</> <type>text</>]
+                            [, <parameter>ssl_inuse</> <type>text</>)</function></literal>
+       </entry>
+       <entry><type>record</type></entry>
+       <entry>scan <filename>pg_hba.conf</> and return examined entries up to a matching one</entry>
+      </row>
      </tbody>
     </tgroup>
    </table>
@@ -16736,6 +16749,32 @@ SELECT set_config('log_statement_stats', 'off', false);
 </programlisting>
    </para>
 
+   <para>
+    <function>pg_hba_lookup</function> returns a set of records containing the
+    line number, mode, type, database, user_name, address, netmask, hostname,
+    method, options and skip reason. For example, to debug problems with user
+    <literal>kommih</> trying to connect to a database <literal>postgres</>
+    from IPv6-address <literal>::1</>, one can issue a following query:
+<programlisting>
+postgres=# SELECT * FROM pg_hba_lookup('postgres', 'kommih', '::1');
+ line_number |  mode   | type  | database | user_name |  address  |                 netmask                 | hostname | method | options |          reason          
+-------------+---------+-------+----------+-----------+-----------+-----------------------------------------+----------+--------+---------+--------------------------
+          84 | skipped | local | {all}    | {all}     |           |                                         |          | trust  | {}      | connection type mismatch
+          86 | skipped | host  | {all}    | {all}     | 127.0.0.1 | 255.255.255.255                         |          | trust  | {}      | IP address mismatch
+          88 | matched | host  | {all}    | {all}     | ::1       | ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff |          | trust  | {}      | 
+(3 rows)
+
+</programlisting>
+    This function actually loads the contents of <filename>pg_hba.conf</> file
+    into memory to perform matching, thus a database administrator can use it
+    to test the effects of changes made to the file in isolation prior to
+    actually applying the configuration cluster-wide with a signal to the
+    postmaster process.
+
+    Only superusers can access this function to look the
+    <filename>pg_hba.conf</> entries up.
+   </para>
+   
   </sect2>
 
   <sect2 id="functions-admin-signal">
diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql
index 923fe58..2943d41 100644
--- a/src/backend/catalog/system_views.sql
+++ b/src/backend/catalog/system_views.sql
@@ -965,3 +965,12 @@ RETURNS jsonb
 LANGUAGE INTERNAL
 STRICT IMMUTABLE
 AS 'jsonb_set';
+
+CREATE OR REPLACE FUNCTION pg_hba_lookup(IN database text, IN user_name text,
+    IN address text DEFAULT NULL, IN ssl_inuse boolean DEFAULT false,
+	OUT line_number int, OUT mode text, OUT type text, OUT database text[],
+	OUT user_name text[], OUT address inet, OUT netmask inet,
+        OUT hostname text, OUT method text, OUT options jsonb, OUT reason text)
+RETURNS SETOF RECORD
+LANGUAGE INTERNAL
+AS 'pg_hba_lookup';
diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index 9f94e63..d0099dc 100644
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -25,15 +25,22 @@
 #include <arpa/inet.h>
 #include <unistd.h>
 
+#include "access/htup_details.h"
+#include "catalog/objectaddress.h"
 #include "catalog/pg_collation.h"
+#include "catalog/pg_type.h"
+#include "funcapi.h"
 #include "libpq/ip.h"
 #include "libpq/libpq.h"
+#include "miscadmin.h"
 #include "postmaster/postmaster.h"
 #include "regex/regex.h"
 #include "replication/walsender.h"
 #include "storage/fd.h"
 #include "utils/acl.h"
+#include "utils/builtins.h"
 #include "utils/guc.h"
+#include "utils/jsonb.h"
 #include "utils/lsyscache.h"
 #include "utils/memutils.h"
 
@@ -52,6 +59,8 @@
 #define MAX_TOKEN	256
 #define MAX_LINE	8192
 
+#define NUM_PG_HBA_LOOKUP_ATTS	 11
+
 /* callback data for check_network_callback */
 typedef struct check_network_data
 {
@@ -75,6 +84,24 @@ typedef struct HbaToken
 } HbaToken;
 
 /*
+ * Optional callback function type for check_hba() function.
+ * Currently, valid callback function is passed to check_hba()
+ * by pg_hba_lookup system function to frame the hba tuple row
+ * based on inputs provided by the user.
+ */
+typedef void (*hba_line_callback) (void *context, HbaLine *hba_line,
+											   const char *reason);
+
+/* Context to use with hba_line_callback function. */
+typedef struct
+{
+	MemoryContext memcxt;
+	TupleDesc	tupdesc;
+	Tuplestorestate *tuple_store;
+}	HbalineContext;
+
+
+/*
  * pre-parsed content of HBA config file: list of HbaLine structs.
  * parsed_hba_context is the memory context where it lives.
  */
@@ -99,6 +126,9 @@ static List *tokenize_inc_file(List *tokens, const char *outer_filename,
 				  const char *inc_filename);
 static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
 				   int line_num);
+static Datum getauthmethod(UserAuth auth_method);
+static Jsonb *gethba_options(HbaLine *hba);
+static void lookup_hba_line_callback(void *context, HbaLine *hba, const char *reason);
 
 /*
  * isblank() exists in the ISO C99 spec, but it's not very portable yet,
@@ -1640,7 +1670,8 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num)
  *	request.
  */
 static void
-check_hba(hbaPort *port)
+check_hba(hbaPort *port, hba_line_callback callback,
+		  void *callback_context)
 {
 	Oid			roleid;
 	ListCell   *line;
@@ -1657,25 +1688,41 @@ check_hba(hbaPort *port)
 		if (hba->conntype == ctLocal)
 		{
 			if (!IS_AF_UNIX(port->raddr.addr.ss_family))
+			{
+				if (callback)
+					callback(callback_context, hba, _("connection type mismatch"));
 				continue;
+			}
 		}
 		else
 		{
 			if (IS_AF_UNIX(port->raddr.addr.ss_family))
+			{
+				if (callback)
+					callback(callback_context, hba, _("connection type mismatch"));
 				continue;
+			}
 
 			/* Check SSL state */
 			if (port->ssl_in_use)
 			{
 				/* Connection is SSL, match both "host" and "hostssl" */
 				if (hba->conntype == ctHostNoSSL)
+				{
+					if (callback)
+						callback(callback_context, hba, _("connection type mismatch"));
 					continue;
+				}
 			}
 			else
 			{
 				/* Connection is not SSL, match both "host" and "hostnossl" */
 				if (hba->conntype == ctHostSSL)
+				{
+					if (callback)
+						callback(callback_context, hba, _("connection type mismatch"));
 					continue;
+				}
 			}
 
 			/* Check IP address */
@@ -1686,14 +1733,22 @@ check_hba(hbaPort *port)
 					{
 						if (!check_hostname(port,
 											hba->hostname))
+						{
+							if (callback)
+								callback(callback_context, hba, _("hostname mismatch"));
 							continue;
+						}
 					}
 					else
 					{
 						if (!check_ip(&port->raddr,
 									  (struct sockaddr *) & hba->addr,
 									  (struct sockaddr *) & hba->mask))
+						{
+							if (callback)
+								callback(callback_context, hba, _("IP address mismatch"));
 							continue;
+						}
 					}
 					break;
 				case ipCmpAll:
@@ -1702,7 +1757,11 @@ check_hba(hbaPort *port)
 				case ipCmpSameNet:
 					if (!check_same_host_or_net(&port->raddr,
 												hba->ip_cmp_method))
+					{
+						if (callback)
+							callback(callback_context, hba, _("samehost/samenet mismatch"));
 						continue;
+					}
 					break;
 				default:
 					/* shouldn't get here, but deem it no-match if so */
@@ -1713,10 +1772,21 @@ check_hba(hbaPort *port)
 		/* Check database and role */
 		if (!check_db(port->database_name, port->user_name, roleid,
 					  hba->databases))
+		{
+			if (callback)
+				callback(callback_context, hba, _("database name mismatch"));
 			continue;
+		}
 
 		if (!check_role(port->user_name, roleid, hba->roles))
+		{
+			if (callback)
+				callback(callback_context, hba, _("user name mismatch"));
 			continue;
+		}
+
+		if (callback)
+			callback(callback_context, hba, NULL);
 
 		/* Found a record that matched! */
 		port->hba = hba;
@@ -2256,5 +2326,505 @@ discard_ident(void)
 void
 hba_getauthmethod(hbaPort *port)
 {
-	check_hba(port);
+	check_hba(port, NULL, NULL);
+}
+
+
+/*
+ * Returns the Text Datum representation of authentication method
+ */
+static Datum
+getauthmethod(UserAuth auth_method)
+{
+	Datum		result;
+
+	switch (auth_method)
+	{
+		case uaReject:
+			result = CStringGetTextDatum("reject");
+			break;
+		case uaTrust:
+			result = CStringGetTextDatum("trust");
+			break;
+		case uaIdent:
+			result = CStringGetTextDatum("ident");
+			break;
+		case uaPassword:
+			result = CStringGetTextDatum("password");
+			break;
+		case uaMD5:
+			result = CStringGetTextDatum("md5");
+			break;
+		case uaGSS:
+			result = CStringGetTextDatum("gss");
+			break;
+		case uaSSPI:
+			result = CStringGetTextDatum("sspi");
+			break;
+		case uaPAM:
+			result = CStringGetTextDatum("pam");
+			break;
+		case uaLDAP:
+			result = CStringGetTextDatum("ldap");
+			break;
+		case uaCert:
+			result = CStringGetTextDatum("cert");
+			break;
+		case uaRADIUS:
+			result = CStringGetTextDatum("radius");
+			break;
+		case uaPeer:
+			result = CStringGetTextDatum("peer");
+			break;
+		default:
+			elog(ERROR, "unexpected authentication method in parsed HBA entry");
+			break;
+	}
+
+	return result;
+}
+
+static Jsonb *
+gethba_options(HbaLine *hba)
+{
+	JsonbParseState *parseState = NULL;
+	JsonbValue *result;
+
+	result = pushJsonbValue(&parseState, WJB_BEGIN_OBJECT, NULL);
+
+	if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
+	{
+		if (hba->include_realm)
+		{
+			push_jsonb_string_key(&parseState, "include_realm");
+			push_jsonb_bool_value(&parseState, true);
+		}
+
+		if (hba->krb_realm)
+		{
+			push_jsonb_string_key(&parseState, "krb_realm");
+			push_jsonb_string_value(&parseState, hba->krb_realm);
+		}
+	}
+
+	if (hba->usermap)
+	{
+		push_jsonb_string_key(&parseState, "map");
+		push_jsonb_string_value(&parseState, hba->usermap);
+	}
+
+	if (hba->clientcert)
+	{
+		push_jsonb_string_key(&parseState, "clientcert");
+		push_jsonb_bool_value(&parseState, true);
+	}
+
+	if (hba->pamservice)
+	{
+		push_jsonb_string_key(&parseState, "pamservice");
+		push_jsonb_string_value(&parseState, hba->pamservice);
+	}
+
+	if (hba->auth_method == uaLDAP)
+	{
+		if (hba->ldapserver)
+		{
+			push_jsonb_string_key(&parseState, "ldapserver");
+			push_jsonb_string_value(&parseState, hba->ldapserver);
+		}
+
+		if (hba->ldapport)
+		{
+			push_jsonb_string_key(&parseState, "ldapport");
+			push_jsonb_int32_value(&parseState, hba->ldapport);
+		}
+
+		if (hba->ldaptls)
+		{
+			push_jsonb_string_key(&parseState, "ldaptls");
+			push_jsonb_bool_value(&parseState, true);
+		}
+
+		if (hba->ldapprefix)
+		{
+			push_jsonb_string_key(&parseState, "ldapprefix");
+			push_jsonb_string_value(&parseState, hba->ldapprefix);
+		}
+
+		if (hba->ldapsuffix)
+		{
+			push_jsonb_string_key(&parseState, "ldapsuffix");
+			push_jsonb_string_value(&parseState, hba->ldapsuffix);
+		}
+
+		if (hba->ldapbasedn)
+		{
+			push_jsonb_string_key(&parseState, "ldapbasedn");
+			push_jsonb_string_value(&parseState, hba->ldapbasedn);
+		}
+
+		if (hba->ldapbinddn)
+		{
+			push_jsonb_string_key(&parseState, "ldapbinddn");
+			push_jsonb_string_value(&parseState, hba->ldapbinddn);
+		}
+
+		if (hba->ldapbindpasswd)
+		{
+			push_jsonb_string_key(&parseState, "ldapbindpasswd");
+			push_jsonb_string_value(&parseState, hba->ldapbindpasswd);
+		}
+
+		if (hba->ldapsearchattribute)
+		{
+			push_jsonb_string_key(&parseState, "ldapsearchattribute");
+			push_jsonb_string_value(&parseState, hba->ldapsearchattribute);
+		}
+
+		if (hba->ldapscope)
+		{
+			push_jsonb_string_key(&parseState, "ldapscope");
+			push_jsonb_int32_value(&parseState, hba->ldapscope);
+		}
+	}
+
+	if (hba->auth_method == uaRADIUS)
+	{
+		if (hba->radiusserver)
+		{
+			push_jsonb_string_key(&parseState, "radiusserver");
+			push_jsonb_string_value(&parseState, hba->radiusserver);
+		}
+
+		if (hba->radiussecret)
+		{
+			push_jsonb_string_key(&parseState, "radiussecret");
+			push_jsonb_string_value(&parseState, hba->radiussecret);
+		}
+
+		if (hba->radiusidentifier)
+		{
+			push_jsonb_string_key(&parseState, "radiusidentifier");
+			push_jsonb_string_value(&parseState, hba->radiusidentifier);
+		}
+
+		if (hba->radiusport)
+		{
+			push_jsonb_string_key(&parseState, "radiusport");
+			push_jsonb_int32_value(&parseState, hba->radiusport);
+		}
+	}
+
+	result = pushJsonbValue(&parseState, WJB_END_OBJECT, NULL);
+	return JsonbValueToJsonb(result);
+}
+
+
+static void
+lookup_hba_line_callback(void *context, HbaLine *hba, const char *reason)
+{
+	Datum		values[NUM_PG_HBA_LOOKUP_ATTS];
+	bool		nulls[NUM_PG_HBA_LOOKUP_ATTS];
+	ListCell   *dbcell;
+	char		buffer[NI_MAXHOST];
+	HeapTuple	tuple;
+	int			index;
+	MemoryContext old_cxt;
+	HbalineContext *mycxt;
+
+	mycxt = (HbalineContext *) context;
+
+	index = 0;
+	memset(values, 0, sizeof(values));
+	memset(nulls, 0, sizeof(nulls));
+
+	old_cxt = MemoryContextSwitchTo(mycxt->memcxt);
+
+	/* line_number */
+	values[index] = Int32GetDatum(hba->linenumber);
+
+	/* mode */
+	index++;
+	if (reason == NULL)
+		values[index] = CStringGetTextDatum(_("matched"));
+	else
+		values[index] = CStringGetTextDatum(_("skipped"));
+
+	/* type */
+	index++;
+	switch (hba->conntype)
+	{
+		case ctLocal:
+			values[index] = CStringGetTextDatum("local");
+			break;
+		case ctHost:
+			values[index] = CStringGetTextDatum("host");
+			break;
+		case ctHostSSL:
+			values[index] = CStringGetTextDatum("hostssl");
+			break;
+		case ctHostNoSSL:
+			values[index] = CStringGetTextDatum("hostnossl");
+			break;
+		default:
+			elog(ERROR, "unexpected connection type in parsed HBA entry");
+			break;
+	}
+
+	/* database */
+	index++;
+	if (list_length(hba->databases) != 0)
+	{
+		List	   *names = NULL;
+		HbaToken   *tok;
+
+		foreach(dbcell, hba->databases)
+		{
+			tok = lfirst(dbcell);
+			names = lappend(names, tok->string);
+		}
+
+		values[index] = PointerGetDatum(strlist_to_textarray(names));
+	}
+	else
+		nulls[index] = true;
+
+	/* user */
+	index++;
+	if (list_length(hba->roles) != 0)
+	{
+		List	   *roles = NULL;
+		HbaToken   *tok;
+
+		foreach(dbcell, hba->roles)
+		{
+			tok = lfirst(dbcell);
+			roles = lappend(roles, tok->string);
+		}
+
+		values[index] = PointerGetDatum(strlist_to_textarray(roles));
+	}
+	else
+		nulls[index] = true;
+
+	/* address */
+	index++;
+	if (pg_getnameinfo_all(&hba->addr, sizeof(struct sockaddr_storage),
+						   buffer, sizeof(buffer),
+						   NULL, 0,
+						   NI_NUMERICHOST) == 0)
+	{
+		clean_ipv6_addr(hba->addr.ss_family, buffer);
+		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+	}
+	else
+		nulls[index] = true;
+
+	/* netmask */
+	index++;
+	if (pg_getnameinfo_all(&hba->mask, sizeof(struct sockaddr_storage),
+						   buffer, sizeof(buffer),
+						   NULL, 0,
+						   NI_NUMERICHOST) == 0)
+	{
+		clean_ipv6_addr(hba->mask.ss_family, buffer);
+		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+	}
+	else
+		nulls[index] = true;
+
+	/* hostname */
+	index++;
+	if (hba->hostname)
+		values[index] = CStringGetTextDatum(hba->hostname);
+	else
+		nulls[index] = true;
+
+	/* method */
+	index++;
+	values[index] = getauthmethod(hba->auth_method);
+
+	/* options */
+	index++;
+	values[index] = PointerGetDatum(gethba_options(hba));
+
+	/* reason */
+	index++;
+	if (reason)
+		values[index] = CStringGetTextDatum(reason);
+	else
+		nulls[index] = true;
+
+	tuple = heap_form_tuple(mycxt->tupdesc, values, nulls);
+	tuplestore_puttuple(mycxt->tuple_store, tuple);
+
+	MemoryContextSwitchTo(old_cxt);
+	return;
+}
+
+/*
+ * SQL-accessible SRF to return all the settings from the pg_hba.conf
+ * file.
+ */
+Datum
+pg_hba_lookup(PG_FUNCTION_ARGS)
+{
+	hbaPort    *port;
+	Tuplestorestate *tuple_store;
+	TupleDesc	tupdesc;
+	MemoryContext old_cxt;
+	HbalineContext *mycxt;
+	ReturnSetInfo *rsi;
+
+	if (!superuser())
+		ereport(ERROR,
+				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+				 (errmsg("must be superuser to view pg_hba.conf settings"))));
+
+	/*
+	 * We must use the Materialize mode to be safe against HBA file reloads
+	 * while the cursor is open. It's also more efficient than having to look
+	 * up our current position in the parsed list every time.
+	 */
+	rsi = (ReturnSetInfo *) fcinfo->resultinfo;
+
+	if (!rsi || !IsA(rsi, ReturnSetInfo) ||
+		(rsi->allowedModes & SFRM_Materialize) == 0)
+		ereport(ERROR,
+				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+				 errmsg("set-valued function called in context that cannot accept a set")));
+
+	port = palloc0(sizeof(hbaPort));
+
+	if (PG_ARGISNULL(0))
+		ereport(ERROR,
+				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+				 (errmsg("database name is required to match pg_hba configuration entry"))));
+	else
+		port->database_name = TextDatumGetCString(PG_GETARG_DATUM(0));
+
+	if (PG_ARGISNULL(1))
+		ereport(ERROR,
+				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+				 (errmsg("user name is required to match pg_hba configuration entry"))));
+	else
+		port->user_name = TextDatumGetCString(PG_GETARG_DATUM(1));
+
+
+	if (!PG_ARGISNULL(2))
+	{
+		char	   *address = NULL;
+		struct addrinfo *gai_result = NULL;
+		struct addrinfo hints;
+		int			ret;
+
+		address = TextDatumGetCString(PG_GETARG_DATUM(2));
+
+		/* Get the IP address either way */
+		hints.ai_flags = AI_NUMERICHOST;
+		hints.ai_family = AF_UNSPEC;
+		hints.ai_socktype = 0;
+		hints.ai_protocol = 0;
+		hints.ai_addrlen = 0;
+		hints.ai_canonname = NULL;
+		hints.ai_addr = NULL;
+		hints.ai_next = NULL;
+
+		ret = getaddrinfo(address, NULL, &hints, &gai_result);
+		if (ret == 0 && gai_result)
+			memcpy(&port->raddr.addr, gai_result->ai_addr, gai_result->ai_addrlen);
+		else if (ret == EAI_NONAME)
+		{
+			struct addrinfo *gai_result2 = NULL;
+
+			port->remote_hostname = pstrdup(address);
+
+			ret = getaddrinfo(port->remote_hostname, NULL, NULL, &gai_result2);
+			if (ret == 0 && gai_result2)
+				memcpy(&port->raddr.addr, gai_result2->ai_addr, gai_result2->ai_addrlen);
+			else
+				ereport(ERROR,
+				(errmsg("getaddrinfo failed to look into hostname \"%s\": %s",
+						port->remote_hostname, gai_strerror(ret))));
+
+			if (gai_result2)
+				freeaddrinfo(gai_result2);
+		}
+		else
+			ereport(ERROR,
+					(errmsg("invalid IP address \"%s\": %s",
+							address, gai_strerror(ret))));
+		if (gai_result)
+			freeaddrinfo(gai_result);
+	}
+	else
+		port->raddr.addr.ss_family = AF_UNIX;
+
+	port->ssl_in_use = DatumGetBool(PG_GETARG_DATUM(3));
+
+	rsi->returnMode = SFRM_Materialize;
+
+	if (!load_hba())
+		ereport(ERROR,
+				(errmsg("failed to load pg_hba.conf file"),
+			   errhint("more details may be available in the server log.")));
+
+	/*
+	 * Create the tupledesc and tuplestore in the per_query context as
+	 * required for SFRM_Materialize.
+	 */
+	old_cxt = MemoryContextSwitchTo(rsi->econtext->ecxt_per_query_memory);
+
+	tupdesc = CreateTemplateTupleDesc(NUM_PG_HBA_LOOKUP_ATTS, false);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 1, "line_number",
+					   INT4OID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 2, "mode",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 3, "type",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 4, "database",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 5, "user_name",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 6, "address",
+					   INETOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 7, "netmask",
+					   INETOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 8, "hostname",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 9, "method",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 10, "options",
+					   JSONBOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 11, "reason",
+					   TEXTOID, -1, 0);
+	BlessTupleDesc(tupdesc);
+
+	tuple_store =
+		tuplestore_begin_heap(rsi->allowedModes & SFRM_Materialize_Random,
+							  false, work_mem);
+
+	MemoryContextSwitchTo(old_cxt);
+
+	mycxt = (HbalineContext *) palloc(sizeof(HbalineContext));
+	mycxt->memcxt = AllocSetContextCreate(CurrentMemoryContext,
+										  "pg_hba_lookup tuple cxt",
+										  ALLOCSET_DEFAULT_MINSIZE,
+										  ALLOCSET_DEFAULT_INITSIZE,
+										  ALLOCSET_DEFAULT_MAXSIZE);
+	mycxt->tupdesc = tupdesc;
+	mycxt->tuple_store = tuple_store;
+
+	check_hba(port, lookup_hba_line_callback, mycxt);
+
+	MemoryContextDelete(mycxt->memcxt);
+	pfree(mycxt);
+
+	/* Clean up the memory allocated by load_hba() explicitly. */
+	discard_hba();
+
+	rsi->setDesc = tupdesc;
+	rsi->setResult = tuple_store;
+
+	PG_RETURN_NULL();
 }
diff --git a/src/backend/utils/adt/jsonb_util.c b/src/backend/utils/adt/jsonb_util.c
index e1ceea6..171e532 100644
--- a/src/backend/utils/adt/jsonb_util.c
+++ b/src/backend/utils/adt/jsonb_util.c
@@ -1802,3 +1802,49 @@ uniqueifyJsonbObject(JsonbValue *object)
 		object->val.object.nPairs = res + 1 - object->val.object.pairs;
 	}
 }
+
+void
+push_jsonb_string_key(JsonbParseState **pstate, char *string_key)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvString;
+	jb.val.string.len = strlen(string_key);
+	jb.val.string.val = pstrdup(string_key);
+	pushJsonbValue(pstate, WJB_KEY, &jb);
+}
+
+void
+push_jsonb_bool_value(JsonbParseState **pstate, bool bool_val)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvBool;
+	jb.val.boolean = bool_val;
+
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
+
+void
+push_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val)
+{
+	JsonbValue	jb;
+	char		outputstr[64];
+
+	snprintf(outputstr, 64, "%d", int32_val);
+	jb.type = jbvNumeric;
+	jb.val.numeric = DatumGetNumeric(DirectFunctionCall3(numeric_in, CStringGetDatum(outputstr), 0, -1));
+
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
+
+void
+push_jsonb_string_value(JsonbParseState **pstate, char *string_value)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvString;
+	jb.val.string.len = strlen(string_value);
+	jb.val.string.val = pstrdup(string_value);
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
diff --git a/src/include/catalog/pg_proc.h b/src/include/catalog/pg_proc.h
index 5ded13e..1ecd90b 100644
--- a/src/include/catalog/pg_proc.h
+++ b/src/include/catalog/pg_proc.h
@@ -3004,6 +3004,8 @@ DATA(insert OID = 2084 (  pg_show_all_settings	PGNSP PGUID 12 1 1000 0 0 f f f f
 DESCR("SHOW ALL as a function");
 DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
 DESCR("show config file settings");
+DATA(insert OID = 3997 (  pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f f t v u 4 0 2249 "25 25 25 16" "{25,25,25,16,23,25,25,1009,1009,869,869,25,25,3802,25}" "{i,i,i,i,o,o,o,o,o,o,o,o,o,o,o}" "{database,user_name,address,ssl_inuse,line_number,mode,type,database,user_name,address,netmask,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+DESCR("view client authentication settings");
 DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
 DESCR("view system lock information");
 DATA(insert OID = 1065 (  pg_prepared_xact PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{28,25,1184,26,26}" "{o,o,o,o,o}" "{transaction,gid,prepared,ownerid,dbid}" _null_ _null_ pg_prepared_xact _null_ _null_ _null_ ));
diff --git a/src/include/utils/builtins.h b/src/include/utils/builtins.h
index 5e8e832..49fff86 100644
--- a/src/include/utils/builtins.h
+++ b/src/include/utils/builtins.h
@@ -1143,6 +1143,9 @@ extern Datum set_config_by_name(PG_FUNCTION_ARGS);
 extern Datum show_all_settings(PG_FUNCTION_ARGS);
 extern Datum show_all_file_settings(PG_FUNCTION_ARGS);
 
+/* hba.c */
+extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
+
 /* rls.c */
 extern Datum row_security_active(PG_FUNCTION_ARGS);
 extern Datum row_security_active_name(PG_FUNCTION_ARGS);
diff --git a/src/include/utils/jsonb.h b/src/include/utils/jsonb.h
index 5f49d8d..33e00d2 100644
--- a/src/include/utils/jsonb.h
+++ b/src/include/utils/jsonb.h
@@ -427,6 +427,12 @@ extern bool JsonbDeepContains(JsonbIterator **val,
 				  JsonbIterator **mContained);
 extern void JsonbHashScalarValue(const JsonbValue *scalarVal, uint32 *hash);
 
+/* jsonb_util.c support functions */
+void push_jsonb_string_key(JsonbParseState **pstate, char *string_key);
+void push_jsonb_bool_value(JsonbParseState **pstate, bool bool_val);
+void push_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val);
+void push_jsonb_string_value(JsonbParseState **pstate, char *string_value);
+
 /* jsonb.c support functions */
 extern char *JsonbToCString(StringInfo out, JsonbContainer *in,
 			   int estimated_len);

diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml
index c0b94bc..4583400 100644
--- a/doc/src/sgml/func.sgml
+++ b/doc/src/sgml/func.sgml
@@ -16751,6 +16751,19 @@ SELECT collation for ('foo' COLLATE "de_DE");
        <entry><type>text</type></entry>
        <entry>set parameter and return new value</entry>
       </row>
+      <row>
+       <entry>
+        <indexterm>
+         <primary>pg_hba_lookup</primary>
+        </indexterm>
+        <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+                            <parameter>user_name</> <type>text</>
+                            [, <parameter>address</> <type>text</>]
+                            [, <parameter>ssl_inuse</> <type>text</>)</function></literal>
+       </entry>
+       <entry><type>record</type></entry>
+       <entry>scan <filename>pg_hba.conf</> and return examined entries up to a matching one</entry>
+      </row>
      </tbody>
     </tgroup>
    </table>
@@ -16808,6 +16821,32 @@ SELECT set_config('log_statement_stats', 'off', false);
 </programlisting>
    </para>
 
+   <para>
+    <function>pg_hba_lookup</function> returns a set of records containing the
+    line number, mode, type, database, user_name, address, netmask, hostname,
+    method, options and skip reason. For example, to debug problems with user
+    <literal>kommih</> trying to connect to a database <literal>postgres</>
+    from IPv6-address <literal>::1</>, one can issue a following query:
+<programlisting>
+postgres=# SELECT * FROM pg_hba_lookup('postgres', 'kommih', '::1');
+ line_number |  mode   | type  | database | user_name |  address  |                 netmask                 | hostname | method | options |          reason          
+-------------+---------+-------+----------+-----------+-----------+-----------------------------------------+----------+--------+---------+--------------------------
+          84 | skipped | local | {all}    | {all}     |           |                                         |          | trust  | {}      | connection type mismatch
+          86 | skipped | host  | {all}    | {all}     | 127.0.0.1 | 255.255.255.255                         |          | trust  | {}      | IP address mismatch
+          88 | matched | host  | {all}    | {all}     | ::1       | ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff |          | trust  | {}      | 
+(3 rows)
+
+</programlisting>
+    This function actually loads the contents of <filename>pg_hba.conf</> file
+    into memory to perform matching, thus a database administrator can use it
+    to test the effects of changes made to the file in isolation prior to
+    actually applying the configuration cluster-wide with a signal to the
+    postmaster process.
+
+    Only superusers can access this function to look the
+    <filename>pg_hba.conf</> entries up.
+   </para>
+   
   </sect2>
 
   <sect2 id="functions-admin-signal">
diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql
index abf9a70..615a4d5 100644
--- a/src/backend/catalog/system_views.sql
+++ b/src/backend/catalog/system_views.sql
@@ -971,3 +971,12 @@ RETURNS jsonb
 LANGUAGE INTERNAL
 STRICT IMMUTABLE
 AS 'jsonb_set';
+
+CREATE OR REPLACE FUNCTION pg_hba_lookup(IN database text, IN user_name text,
+    IN address text DEFAULT NULL, IN ssl_inuse boolean DEFAULT false,
+	OUT line_number int, OUT mode text, OUT type text, OUT database text[],
+	OUT user_name text[], OUT address inet, OUT netmask inet,
+        OUT hostname text, OUT method text, OUT options jsonb, OUT reason text)
+RETURNS SETOF RECORD
+LANGUAGE INTERNAL
+AS 'pg_hba_lookup';
diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index 28f9fb5..d0099dc 100644
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -25,15 +25,22 @@
 #include <arpa/inet.h>
 #include <unistd.h>
 
+#include "access/htup_details.h"
+#include "catalog/objectaddress.h"
 #include "catalog/pg_collation.h"
+#include "catalog/pg_type.h"
+#include "funcapi.h"
 #include "libpq/ip.h"
 #include "libpq/libpq.h"
+#include "miscadmin.h"
 #include "postmaster/postmaster.h"
 #include "regex/regex.h"
 #include "replication/walsender.h"
 #include "storage/fd.h"
 #include "utils/acl.h"
+#include "utils/builtins.h"
 #include "utils/guc.h"
+#include "utils/jsonb.h"
 #include "utils/lsyscache.h"
 #include "utils/memutils.h"
 
@@ -52,6 +59,8 @@
 #define MAX_TOKEN	256
 #define MAX_LINE	8192
 
+#define NUM_PG_HBA_LOOKUP_ATTS	 11
+
 /* callback data for check_network_callback */
 typedef struct check_network_data
 {
@@ -75,6 +84,24 @@ typedef struct HbaToken
 } HbaToken;
 
 /*
+ * Optional callback function type for check_hba() function.
+ * Currently, valid callback function is passed to check_hba()
+ * by pg_hba_lookup system function to frame the hba tuple row
+ * based on inputs provided by the user.
+ */
+typedef void (*hba_line_callback) (void *context, HbaLine *hba_line,
+											   const char *reason);
+
+/* Context to use with hba_line_callback function. */
+typedef struct
+{
+	MemoryContext memcxt;
+	TupleDesc	tupdesc;
+	Tuplestorestate *tuple_store;
+}	HbalineContext;
+
+
+/*
  * pre-parsed content of HBA config file: list of HbaLine structs.
  * parsed_hba_context is the memory context where it lives.
  */
@@ -99,6 +126,9 @@ static List *tokenize_inc_file(List *tokens, const char *outer_filename,
 				  const char *inc_filename);
 static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
 				   int line_num);
+static Datum getauthmethod(UserAuth auth_method);
+static Jsonb *gethba_options(HbaLine *hba);
+static void lookup_hba_line_callback(void *context, HbaLine *hba, const char *reason);
 
 /*
  * isblank() exists in the ISO C99 spec, but it's not very portable yet,
@@ -1640,7 +1670,8 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num)
  *	request.
  */
 static void
-check_hba(hbaPort *port)
+check_hba(hbaPort *port, hba_line_callback callback,
+		  void *callback_context)
 {
 	Oid			roleid;
 	ListCell   *line;
@@ -1657,25 +1688,41 @@ check_hba(hbaPort *port)
 		if (hba->conntype == ctLocal)
 		{
 			if (!IS_AF_UNIX(port->raddr.addr.ss_family))
+			{
+				if (callback)
+					callback(callback_context, hba, _("connection type mismatch"));
 				continue;
+			}
 		}
 		else
 		{
 			if (IS_AF_UNIX(port->raddr.addr.ss_family))
+			{
+				if (callback)
+					callback(callback_context, hba, _("connection type mismatch"));
 				continue;
+			}
 
 			/* Check SSL state */
 			if (port->ssl_in_use)
 			{
 				/* Connection is SSL, match both "host" and "hostssl" */
 				if (hba->conntype == ctHostNoSSL)
+				{
+					if (callback)
+						callback(callback_context, hba, _("connection type mismatch"));
 					continue;
+				}
 			}
 			else
 			{
 				/* Connection is not SSL, match both "host" and "hostnossl" */
 				if (hba->conntype == ctHostSSL)
+				{
+					if (callback)
+						callback(callback_context, hba, _("connection type mismatch"));
 					continue;
+				}
 			}
 
 			/* Check IP address */
@@ -1686,14 +1733,22 @@ check_hba(hbaPort *port)
 					{
 						if (!check_hostname(port,
 											hba->hostname))
+						{
+							if (callback)
+								callback(callback_context, hba, _("hostname mismatch"));
 							continue;
+						}
 					}
 					else
 					{
 						if (!check_ip(&port->raddr,
 									  (struct sockaddr *) & hba->addr,
 									  (struct sockaddr *) & hba->mask))
+						{
+							if (callback)
+								callback(callback_context, hba, _("IP address mismatch"));
 							continue;
+						}
 					}
 					break;
 				case ipCmpAll:
@@ -1702,7 +1757,11 @@ check_hba(hbaPort *port)
 				case ipCmpSameNet:
 					if (!check_same_host_or_net(&port->raddr,
 												hba->ip_cmp_method))
+					{
+						if (callback)
+							callback(callback_context, hba, _("samehost/samenet mismatch"));
 						continue;
+					}
 					break;
 				default:
 					/* shouldn't get here, but deem it no-match if so */
@@ -1713,10 +1772,21 @@ check_hba(hbaPort *port)
 		/* Check database and role */
 		if (!check_db(port->database_name, port->user_name, roleid,
 					  hba->databases))
+		{
+			if (callback)
+				callback(callback_context, hba, _("database name mismatch"));
 			continue;
+		}
 
 		if (!check_role(port->user_name, roleid, hba->roles))
+		{
+			if (callback)
+				callback(callback_context, hba, _("user name mismatch"));
 			continue;
+		}
+
+		if (callback)
+			callback(callback_context, hba, NULL);
 
 		/* Found a record that matched! */
 		port->hba = hba;
@@ -1770,8 +1840,7 @@ load_hba(void)
 	FreeFile(file);
 
 	/* Now parse all the lines */
-	Assert(PostmasterContext);
-	hbacxt = AllocSetContextCreate(PostmasterContext,
+	hbacxt = AllocSetContextCreate(CurrentMemoryContext,
 								   "hba parser context",
 								   ALLOCSET_DEFAULT_MINSIZE,
 								   ALLOCSET_DEFAULT_MINSIZE,
@@ -1829,14 +1898,26 @@ load_hba(void)
 	}
 
 	/* Loaded new file successfully, replace the one we use */
-	if (parsed_hba_context != NULL)
-		MemoryContextDelete(parsed_hba_context);
+	discard_hba();
 	parsed_hba_context = hbacxt;
 	parsed_hba_lines = new_parsed_lines;
 
 	return true;
 }
 
+
+void
+discard_hba(void)
+{
+	if (parsed_hba_context != NULL)
+	{
+		MemoryContextDelete(parsed_hba_context);
+		parsed_hba_context = NULL;
+		parsed_hba_lines = NIL;
+	}
+}
+
+
 /*
  * Parse one tokenised line from the ident config file and store the result in
  * an IdentLine structure, or NULL if parsing fails.
@@ -2148,8 +2229,7 @@ load_ident(void)
 	FreeFile(file);
 
 	/* Now parse all the lines */
-	Assert(PostmasterContext);
-	ident_context = AllocSetContextCreate(PostmasterContext,
+	ident_context = AllocSetContextCreate(CurrentMemoryContext,
 										  "ident parser context",
 										  ALLOCSET_DEFAULT_MINSIZE,
 										  ALLOCSET_DEFAULT_MINSIZE,
@@ -2202,6 +2282,20 @@ load_ident(void)
 	}
 
 	/* Loaded new file successfully, replace the one we use */
+	discard_ident();
+	parsed_ident_context = ident_context;
+	parsed_ident_lines = new_parsed_lines;
+
+	return true;
+}
+
+
+void
+discard_ident(void)
+{
+	ListCell   *parsed_line_cell;
+	IdentLine  *newline;
+
 	if (parsed_ident_lines != NIL)
 	{
 		foreach(parsed_line_cell, parsed_ident_lines)
@@ -2210,18 +2304,17 @@ load_ident(void)
 			if (newline->ident_user[0] == '/')
 				pg_regfree(&newline->re);
 		}
+		parsed_ident_lines = NIL;
 	}
+
 	if (parsed_ident_context != NULL)
+	{
 		MemoryContextDelete(parsed_ident_context);
-
-	parsed_ident_context = ident_context;
-	parsed_ident_lines = new_parsed_lines;
-
-	return true;
+		parsed_ident_context = NULL;
+	}
 }
 
 
-
 /*
  *	Determine what authentication method should be used when accessing database
  *	"database" from frontend "raddr", user "user".  Return the method and
@@ -2233,5 +2326,505 @@ load_ident(void)
 void
 hba_getauthmethod(hbaPort *port)
 {
-	check_hba(port);
+	check_hba(port, NULL, NULL);
+}
+
+
+/*
+ * Returns the Text Datum representation of authentication method
+ */
+static Datum
+getauthmethod(UserAuth auth_method)
+{
+	Datum		result;
+
+	switch (auth_method)
+	{
+		case uaReject:
+			result = CStringGetTextDatum("reject");
+			break;
+		case uaTrust:
+			result = CStringGetTextDatum("trust");
+			break;
+		case uaIdent:
+			result = CStringGetTextDatum("ident");
+			break;
+		case uaPassword:
+			result = CStringGetTextDatum("password");
+			break;
+		case uaMD5:
+			result = CStringGetTextDatum("md5");
+			break;
+		case uaGSS:
+			result = CStringGetTextDatum("gss");
+			break;
+		case uaSSPI:
+			result = CStringGetTextDatum("sspi");
+			break;
+		case uaPAM:
+			result = CStringGetTextDatum("pam");
+			break;
+		case uaLDAP:
+			result = CStringGetTextDatum("ldap");
+			break;
+		case uaCert:
+			result = CStringGetTextDatum("cert");
+			break;
+		case uaRADIUS:
+			result = CStringGetTextDatum("radius");
+			break;
+		case uaPeer:
+			result = CStringGetTextDatum("peer");
+			break;
+		default:
+			elog(ERROR, "unexpected authentication method in parsed HBA entry");
+			break;
+	}
+
+	return result;
+}
+
+static Jsonb *
+gethba_options(HbaLine *hba)
+{
+	JsonbParseState *parseState = NULL;
+	JsonbValue *result;
+
+	result = pushJsonbValue(&parseState, WJB_BEGIN_OBJECT, NULL);
+
+	if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
+	{
+		if (hba->include_realm)
+		{
+			push_jsonb_string_key(&parseState, "include_realm");
+			push_jsonb_bool_value(&parseState, true);
+		}
+
+		if (hba->krb_realm)
+		{
+			push_jsonb_string_key(&parseState, "krb_realm");
+			push_jsonb_string_value(&parseState, hba->krb_realm);
+		}
+	}
+
+	if (hba->usermap)
+	{
+		push_jsonb_string_key(&parseState, "map");
+		push_jsonb_string_value(&parseState, hba->usermap);
+	}
+
+	if (hba->clientcert)
+	{
+		push_jsonb_string_key(&parseState, "clientcert");
+		push_jsonb_bool_value(&parseState, true);
+	}
+
+	if (hba->pamservice)
+	{
+		push_jsonb_string_key(&parseState, "pamservice");
+		push_jsonb_string_value(&parseState, hba->pamservice);
+	}
+
+	if (hba->auth_method == uaLDAP)
+	{
+		if (hba->ldapserver)
+		{
+			push_jsonb_string_key(&parseState, "ldapserver");
+			push_jsonb_string_value(&parseState, hba->ldapserver);
+		}
+
+		if (hba->ldapport)
+		{
+			push_jsonb_string_key(&parseState, "ldapport");
+			push_jsonb_int32_value(&parseState, hba->ldapport);
+		}
+
+		if (hba->ldaptls)
+		{
+			push_jsonb_string_key(&parseState, "ldaptls");
+			push_jsonb_bool_value(&parseState, true);
+		}
+
+		if (hba->ldapprefix)
+		{
+			push_jsonb_string_key(&parseState, "ldapprefix");
+			push_jsonb_string_value(&parseState, hba->ldapprefix);
+		}
+
+		if (hba->ldapsuffix)
+		{
+			push_jsonb_string_key(&parseState, "ldapsuffix");
+			push_jsonb_string_value(&parseState, hba->ldapsuffix);
+		}
+
+		if (hba->ldapbasedn)
+		{
+			push_jsonb_string_key(&parseState, "ldapbasedn");
+			push_jsonb_string_value(&parseState, hba->ldapbasedn);
+		}
+
+		if (hba->ldapbinddn)
+		{
+			push_jsonb_string_key(&parseState, "ldapbinddn");
+			push_jsonb_string_value(&parseState, hba->ldapbinddn);
+		}
+
+		if (hba->ldapbindpasswd)
+		{
+			push_jsonb_string_key(&parseState, "ldapbindpasswd");
+			push_jsonb_string_value(&parseState, hba->ldapbindpasswd);
+		}
+
+		if (hba->ldapsearchattribute)
+		{
+			push_jsonb_string_key(&parseState, "ldapsearchattribute");
+			push_jsonb_string_value(&parseState, hba->ldapsearchattribute);
+		}
+
+		if (hba->ldapscope)
+		{
+			push_jsonb_string_key(&parseState, "ldapscope");
+			push_jsonb_int32_value(&parseState, hba->ldapscope);
+		}
+	}
+
+	if (hba->auth_method == uaRADIUS)
+	{
+		if (hba->radiusserver)
+		{
+			push_jsonb_string_key(&parseState, "radiusserver");
+			push_jsonb_string_value(&parseState, hba->radiusserver);
+		}
+
+		if (hba->radiussecret)
+		{
+			push_jsonb_string_key(&parseState, "radiussecret");
+			push_jsonb_string_value(&parseState, hba->radiussecret);
+		}
+
+		if (hba->radiusidentifier)
+		{
+			push_jsonb_string_key(&parseState, "radiusidentifier");
+			push_jsonb_string_value(&parseState, hba->radiusidentifier);
+		}
+
+		if (hba->radiusport)
+		{
+			push_jsonb_string_key(&parseState, "radiusport");
+			push_jsonb_int32_value(&parseState, hba->radiusport);
+		}
+	}
+
+	result = pushJsonbValue(&parseState, WJB_END_OBJECT, NULL);
+	return JsonbValueToJsonb(result);
+}
+
+
+static void
+lookup_hba_line_callback(void *context, HbaLine *hba, const char *reason)
+{
+	Datum		values[NUM_PG_HBA_LOOKUP_ATTS];
+	bool		nulls[NUM_PG_HBA_LOOKUP_ATTS];
+	ListCell   *dbcell;
+	char		buffer[NI_MAXHOST];
+	HeapTuple	tuple;
+	int			index;
+	MemoryContext old_cxt;
+	HbalineContext *mycxt;
+
+	mycxt = (HbalineContext *) context;
+
+	index = 0;
+	memset(values, 0, sizeof(values));
+	memset(nulls, 0, sizeof(nulls));
+
+	old_cxt = MemoryContextSwitchTo(mycxt->memcxt);
+
+	/* line_number */
+	values[index] = Int32GetDatum(hba->linenumber);
+
+	/* mode */
+	index++;
+	if (reason == NULL)
+		values[index] = CStringGetTextDatum(_("matched"));
+	else
+		values[index] = CStringGetTextDatum(_("skipped"));
+
+	/* type */
+	index++;
+	switch (hba->conntype)
+	{
+		case ctLocal:
+			values[index] = CStringGetTextDatum("local");
+			break;
+		case ctHost:
+			values[index] = CStringGetTextDatum("host");
+			break;
+		case ctHostSSL:
+			values[index] = CStringGetTextDatum("hostssl");
+			break;
+		case ctHostNoSSL:
+			values[index] = CStringGetTextDatum("hostnossl");
+			break;
+		default:
+			elog(ERROR, "unexpected connection type in parsed HBA entry");
+			break;
+	}
+
+	/* database */
+	index++;
+	if (list_length(hba->databases) != 0)
+	{
+		List	   *names = NULL;
+		HbaToken   *tok;
+
+		foreach(dbcell, hba->databases)
+		{
+			tok = lfirst(dbcell);
+			names = lappend(names, tok->string);
+		}
+
+		values[index] = PointerGetDatum(strlist_to_textarray(names));
+	}
+	else
+		nulls[index] = true;
+
+	/* user */
+	index++;
+	if (list_length(hba->roles) != 0)
+	{
+		List	   *roles = NULL;
+		HbaToken   *tok;
+
+		foreach(dbcell, hba->roles)
+		{
+			tok = lfirst(dbcell);
+			roles = lappend(roles, tok->string);
+		}
+
+		values[index] = PointerGetDatum(strlist_to_textarray(roles));
+	}
+	else
+		nulls[index] = true;
+
+	/* address */
+	index++;
+	if (pg_getnameinfo_all(&hba->addr, sizeof(struct sockaddr_storage),
+						   buffer, sizeof(buffer),
+						   NULL, 0,
+						   NI_NUMERICHOST) == 0)
+	{
+		clean_ipv6_addr(hba->addr.ss_family, buffer);
+		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+	}
+	else
+		nulls[index] = true;
+
+	/* netmask */
+	index++;
+	if (pg_getnameinfo_all(&hba->mask, sizeof(struct sockaddr_storage),
+						   buffer, sizeof(buffer),
+						   NULL, 0,
+						   NI_NUMERICHOST) == 0)
+	{
+		clean_ipv6_addr(hba->mask.ss_family, buffer);
+		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+	}
+	else
+		nulls[index] = true;
+
+	/* hostname */
+	index++;
+	if (hba->hostname)
+		values[index] = CStringGetTextDatum(hba->hostname);
+	else
+		nulls[index] = true;
+
+	/* method */
+	index++;
+	values[index] = getauthmethod(hba->auth_method);
+
+	/* options */
+	index++;
+	values[index] = PointerGetDatum(gethba_options(hba));
+
+	/* reason */
+	index++;
+	if (reason)
+		values[index] = CStringGetTextDatum(reason);
+	else
+		nulls[index] = true;
+
+	tuple = heap_form_tuple(mycxt->tupdesc, values, nulls);
+	tuplestore_puttuple(mycxt->tuple_store, tuple);
+
+	MemoryContextSwitchTo(old_cxt);
+	return;
+}
+
+/*
+ * SQL-accessible SRF to return all the settings from the pg_hba.conf
+ * file.
+ */
+Datum
+pg_hba_lookup(PG_FUNCTION_ARGS)
+{
+	hbaPort    *port;
+	Tuplestorestate *tuple_store;
+	TupleDesc	tupdesc;
+	MemoryContext old_cxt;
+	HbalineContext *mycxt;
+	ReturnSetInfo *rsi;
+
+	if (!superuser())
+		ereport(ERROR,
+				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+				 (errmsg("must be superuser to view pg_hba.conf settings"))));
+
+	/*
+	 * We must use the Materialize mode to be safe against HBA file reloads
+	 * while the cursor is open. It's also more efficient than having to look
+	 * up our current position in the parsed list every time.
+	 */
+	rsi = (ReturnSetInfo *) fcinfo->resultinfo;
+
+	if (!rsi || !IsA(rsi, ReturnSetInfo) ||
+		(rsi->allowedModes & SFRM_Materialize) == 0)
+		ereport(ERROR,
+				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+				 errmsg("set-valued function called in context that cannot accept a set")));
+
+	port = palloc0(sizeof(hbaPort));
+
+	if (PG_ARGISNULL(0))
+		ereport(ERROR,
+				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+				 (errmsg("database name is required to match pg_hba configuration entry"))));
+	else
+		port->database_name = TextDatumGetCString(PG_GETARG_DATUM(0));
+
+	if (PG_ARGISNULL(1))
+		ereport(ERROR,
+				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+				 (errmsg("user name is required to match pg_hba configuration entry"))));
+	else
+		port->user_name = TextDatumGetCString(PG_GETARG_DATUM(1));
+
+
+	if (!PG_ARGISNULL(2))
+	{
+		char	   *address = NULL;
+		struct addrinfo *gai_result = NULL;
+		struct addrinfo hints;
+		int			ret;
+
+		address = TextDatumGetCString(PG_GETARG_DATUM(2));
+
+		/* Get the IP address either way */
+		hints.ai_flags = AI_NUMERICHOST;
+		hints.ai_family = AF_UNSPEC;
+		hints.ai_socktype = 0;
+		hints.ai_protocol = 0;
+		hints.ai_addrlen = 0;
+		hints.ai_canonname = NULL;
+		hints.ai_addr = NULL;
+		hints.ai_next = NULL;
+
+		ret = getaddrinfo(address, NULL, &hints, &gai_result);
+		if (ret == 0 && gai_result)
+			memcpy(&port->raddr.addr, gai_result->ai_addr, gai_result->ai_addrlen);
+		else if (ret == EAI_NONAME)
+		{
+			struct addrinfo *gai_result2 = NULL;
+
+			port->remote_hostname = pstrdup(address);
+
+			ret = getaddrinfo(port->remote_hostname, NULL, NULL, &gai_result2);
+			if (ret == 0 && gai_result2)
+				memcpy(&port->raddr.addr, gai_result2->ai_addr, gai_result2->ai_addrlen);
+			else
+				ereport(ERROR,
+				(errmsg("getaddrinfo failed to look into hostname \"%s\": %s",
+						port->remote_hostname, gai_strerror(ret))));
+
+			if (gai_result2)
+				freeaddrinfo(gai_result2);
+		}
+		else
+			ereport(ERROR,
+					(errmsg("invalid IP address \"%s\": %s",
+							address, gai_strerror(ret))));
+		if (gai_result)
+			freeaddrinfo(gai_result);
+	}
+	else
+		port->raddr.addr.ss_family = AF_UNIX;
+
+	port->ssl_in_use = DatumGetBool(PG_GETARG_DATUM(3));
+
+	rsi->returnMode = SFRM_Materialize;
+
+	if (!load_hba())
+		ereport(ERROR,
+				(errmsg("failed to load pg_hba.conf file"),
+			   errhint("more details may be available in the server log.")));
+
+	/*
+	 * Create the tupledesc and tuplestore in the per_query context as
+	 * required for SFRM_Materialize.
+	 */
+	old_cxt = MemoryContextSwitchTo(rsi->econtext->ecxt_per_query_memory);
+
+	tupdesc = CreateTemplateTupleDesc(NUM_PG_HBA_LOOKUP_ATTS, false);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 1, "line_number",
+					   INT4OID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 2, "mode",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 3, "type",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 4, "database",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 5, "user_name",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 6, "address",
+					   INETOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 7, "netmask",
+					   INETOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 8, "hostname",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 9, "method",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 10, "options",
+					   JSONBOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 11, "reason",
+					   TEXTOID, -1, 0);
+	BlessTupleDesc(tupdesc);
+
+	tuple_store =
+		tuplestore_begin_heap(rsi->allowedModes & SFRM_Materialize_Random,
+							  false, work_mem);
+
+	MemoryContextSwitchTo(old_cxt);
+
+	mycxt = (HbalineContext *) palloc(sizeof(HbalineContext));
+	mycxt->memcxt = AllocSetContextCreate(CurrentMemoryContext,
+										  "pg_hba_lookup tuple cxt",
+										  ALLOCSET_DEFAULT_MINSIZE,
+										  ALLOCSET_DEFAULT_INITSIZE,
+										  ALLOCSET_DEFAULT_MAXSIZE);
+	mycxt->tupdesc = tupdesc;
+	mycxt->tuple_store = tuple_store;
+
+	check_hba(port, lookup_hba_line_callback, mycxt);
+
+	MemoryContextDelete(mycxt->memcxt);
+	pfree(mycxt);
+
+	/* Clean up the memory allocated by load_hba() explicitly. */
+	discard_hba();
+
+	rsi->setDesc = tupdesc;
+	rsi->setResult = tuple_store;
+
+	PG_RETURN_NULL();
 }
diff --git a/src/backend/utils/adt/jsonb_util.c b/src/backend/utils/adt/jsonb_util.c
index e1ceea6..171e532 100644
--- a/src/backend/utils/adt/jsonb_util.c
+++ b/src/backend/utils/adt/jsonb_util.c
@@ -1802,3 +1802,49 @@ uniqueifyJsonbObject(JsonbValue *object)
 		object->val.object.nPairs = res + 1 - object->val.object.pairs;
 	}
 }
+
+void
+push_jsonb_string_key(JsonbParseState **pstate, char *string_key)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvString;
+	jb.val.string.len = strlen(string_key);
+	jb.val.string.val = pstrdup(string_key);
+	pushJsonbValue(pstate, WJB_KEY, &jb);
+}
+
+void
+push_jsonb_bool_value(JsonbParseState **pstate, bool bool_val)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvBool;
+	jb.val.boolean = bool_val;
+
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
+
+void
+push_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val)
+{
+	JsonbValue	jb;
+	char		outputstr[64];
+
+	snprintf(outputstr, 64, "%d", int32_val);
+	jb.type = jbvNumeric;
+	jb.val.numeric = DatumGetNumeric(DirectFunctionCall3(numeric_in, CStringGetDatum(outputstr), 0, -1));
+
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
+
+void
+push_jsonb_string_value(JsonbParseState **pstate, char *string_value)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvString;
+	jb.val.string.len = strlen(string_value);
+	jb.val.string.val = pstrdup(string_value);
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c
index 6b760d4..d92cd9a 100644
--- a/src/backend/utils/init/postinit.c
+++ b/src/backend/utils/init/postinit.c
@@ -191,18 +191,6 @@ PerformAuthentication(Port *port)
 	 * FIXME: [fork/exec] Ugh.  Is there a way around this overhead?
 	 */
 #ifdef EXEC_BACKEND
-	/*
-	 * load_hba() and load_ident() want to work within the PostmasterContext,
-	 * so create that if it doesn't exist (which it won't).  We'll delete it
-	 * again later, in PostgresMain.
-	 */
-	if (PostmasterContext == NULL)
-		PostmasterContext = AllocSetContextCreate(TopMemoryContext,
-												  "Postmaster",
-												  ALLOCSET_DEFAULT_MINSIZE,
-												  ALLOCSET_DEFAULT_INITSIZE,
-												  ALLOCSET_DEFAULT_MAXSIZE);
-
 	if (!load_hba())
 	{
 		/*
@@ -736,6 +724,14 @@ InitPostgres(const char *in_dbname, Oid dboid, const char *username,
 	}
 
 	/*
+	 * We don't need the HBA and ident data going forward, but we can't rely
+	 * on release of PostmasterContext to clean that up, so discard them
+	 * explicitly here.
+	 */
+	discard_hba();
+	discard_ident();
+
+	/*
 	 * If we're trying to shut down, only superusers can connect, and new
 	 * replication connections are not allowed.
 	 */
diff --git a/src/include/catalog/pg_proc.h b/src/include/catalog/pg_proc.h
index aec6c4c..3253382 100644
--- a/src/include/catalog/pg_proc.h
+++ b/src/include/catalog/pg_proc.h
@@ -3010,6 +3010,8 @@ DATA(insert OID = 2084 (  pg_show_all_settings	PGNSP PGUID 12 1 1000 0 0 f f f f
 DESCR("SHOW ALL as a function");
 DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
 DESCR("show config file settings");
+DATA(insert OID = 3997 (  pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f f t v u 4 0 2249 "25 25 25 16" "{25,25,25,16,23,25,25,1009,1009,869,869,25,25,3802,25}" "{i,i,i,i,o,o,o,o,o,o,o,o,o,o,o}" "{database,user_name,address,ssl_inuse,line_number,mode,type,database,user_name,address,netmask,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+DESCR("view client authentication settings");
 DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
 DESCR("view system lock information");
 DATA(insert OID = 2561 (  pg_blocking_pids PGNSP PGUID 12 1 0 0 0 f f f f t f v s 1 0 1007 "23" _null_ _null_ _null_ _null_ _null_ pg_blocking_pids _null_ _null_ _null_ ));
diff --git a/src/include/libpq/hba.h b/src/include/libpq/hba.h
index 68a953a..291300b 100644
--- a/src/include/libpq/hba.h
+++ b/src/include/libpq/hba.h
@@ -98,6 +98,10 @@ typedef struct Port hbaPort;
 
 extern bool load_hba(void);
 extern bool load_ident(void);
+
+extern void discard_hba(void);
+extern void discard_ident(void);
+
 extern void hba_getauthmethod(hbaPort *port);
 extern int check_usermap(const char *usermap_name,
 			  const char *pg_role, const char *auth_user,
diff --git a/src/include/utils/builtins.h b/src/include/utils/builtins.h
index 7ec93c9..24625e5 100644
--- a/src/include/utils/builtins.h
+++ b/src/include/utils/builtins.h
@@ -1151,6 +1151,9 @@ extern Datum show_all_file_settings(PG_FUNCTION_ARGS);
 /* pg_config.c */
 extern Datum pg_config(PG_FUNCTION_ARGS);
 
+/* hba.c */
+extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
+
 /* rls.c */
 extern Datum row_security_active(PG_FUNCTION_ARGS);
 extern Datum row_security_active_name(PG_FUNCTION_ARGS);
diff --git a/src/include/utils/jsonb.h b/src/include/utils/jsonb.h
index 5f49d8d..33e00d2 100644
--- a/src/include/utils/jsonb.h
+++ b/src/include/utils/jsonb.h
@@ -427,6 +427,12 @@ extern bool JsonbDeepContains(JsonbIterator **val,
 				  JsonbIterator **mContained);
 extern void JsonbHashScalarValue(const JsonbValue *scalarVal, uint32 *hash);
 
+/* jsonb_util.c support functions */
+void push_jsonb_string_key(JsonbParseState **pstate, char *string_key);
+void push_jsonb_bool_value(JsonbParseState **pstate, bool bool_val);
+void push_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val);
+void push_jsonb_string_value(JsonbParseState **pstate, char *string_value);
+
 /* jsonb.c support functions */
 extern char *JsonbToCString(StringInfo out, JsonbContainer *in,
 			   int estimated_len);

diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml
index 000489d..9fa8296 100644
--- a/doc/src/sgml/func.sgml
+++ b/doc/src/sgml/func.sgml
@@ -17194,6 +17194,19 @@ SELECT collation for ('foo' COLLATE "de_DE");
        <entry><type>text</type></entry>
        <entry>set parameter and return new value</entry>
       </row>
+      <row>
+       <entry>
+        <indexterm>
+         <primary>pg_hba_lookup</primary>
+        </indexterm>
+        <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+                            <parameter>user_name</> <type>text</>
+                            [, <parameter>address</> <type>text</>]
+                            [, <parameter>ssl_inuse</> <type>text</>)</function></literal>
+       </entry>
+       <entry><type>record</type></entry>
+       <entry>scan <filename>pg_hba.conf</> and return examined entries up to a matching one</entry>
+      </row>
      </tbody>
     </tgroup>
    </table>
@@ -17251,6 +17264,32 @@ SELECT set_config('log_statement_stats', 'off', false);
 </programlisting>
    </para>
 
+   <para>
+    <function>pg_hba_lookup</function> returns a set of records containing the
+    line number, mode, type, database, user_name, address, netmask, hostname,
+    method, options and skip reason. For example, to debug problems with user
+    <literal>kommih</> trying to connect to a database <literal>postgres</>
+    from IPv6-address <literal>::1</>, one can issue a following query:
+<programlisting>
+postgres=# select * from pg_hba_lookup('postgres', 'kommih', '::1');
+ line_number |  mode   | type  | keyword_database | database | keyword_user | user_name |  address  |                 netmask                 | hostname | method | options |          reason          
+-------------+---------+-------+------------------+----------+--------------+-----------+-----------+-----------------------------------------+----------+--------+---------+--------------------------
+          84 | skipped | local | {all}            |          | {all}        |           |           |                                         |          | trust  | {}      | connection type mismatch
+          86 | skipped | host  | {all}            |          | {all}        |           | 127.0.0.1 | 255.255.255.255                         |          | trust  | {}      | IP address mismatch
+          90 | matched | host  | {all}            |          | {all}        |           | ::1       | ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff |          | trust  | {}      | 
+(3 rows)
+
+</programlisting>
+    This function actually loads the contents of <filename>pg_hba.conf</> file
+    into memory to perform matching, thus a database administrator can use it
+    to test the effects of changes made to the file in isolation prior to
+    actually applying the configuration cluster-wide with a signal to the
+    postmaster process.
+
+    Only superusers can access this function to look the
+    <filename>pg_hba.conf</> entries up.
+   </para>
+   
   </sect2>
 
   <sect2 id="functions-admin-signal">
diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql
index fef67bd..0f45b75 100644
--- a/src/backend/catalog/system_views.sql
+++ b/src/backend/catalog/system_views.sql
@@ -990,3 +990,13 @@ RETURNS jsonb
 LANGUAGE INTERNAL
 STRICT IMMUTABLE
 AS 'jsonb_set';
+
+CREATE OR REPLACE FUNCTION pg_hba_lookup(IN database text, IN user_name text,
+    IN address text DEFAULT NULL, IN ssl_inuse boolean DEFAULT false,
+	OUT line_number int, OUT mode text, OUT type text, OUT keyword_database text[],
+	OUT database text[], OUT keyword_user text[], OUT user_name text[],
+	OUT address inet, OUT netmask inet, OUT hostname text, OUT method text,
+	OUT options jsonb, OUT reason text)
+RETURNS SETOF RECORD
+LANGUAGE INTERNAL
+AS 'pg_hba_lookup';
diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index 28f9fb5..1cbc853 100644
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -25,15 +25,22 @@
 #include <arpa/inet.h>
 #include <unistd.h>
 
+#include "access/htup_details.h"
+#include "catalog/objectaddress.h"
 #include "catalog/pg_collation.h"
+#include "catalog/pg_type.h"
+#include "funcapi.h"
 #include "libpq/ip.h"
 #include "libpq/libpq.h"
+#include "miscadmin.h"
 #include "postmaster/postmaster.h"
 #include "regex/regex.h"
 #include "replication/walsender.h"
 #include "storage/fd.h"
 #include "utils/acl.h"
+#include "utils/builtins.h"
 #include "utils/guc.h"
+#include "utils/jsonb.h"
 #include "utils/lsyscache.h"
 #include "utils/memutils.h"
 
@@ -52,6 +59,8 @@
 #define MAX_TOKEN	256
 #define MAX_LINE	8192
 
+#define NUM_PG_HBA_LOOKUP_ATTS	 13
+
 /* callback data for check_network_callback */
 typedef struct check_network_data
 {
@@ -75,6 +84,24 @@ typedef struct HbaToken
 } HbaToken;
 
 /*
+ * Optional callback function type for check_hba() function.
+ * Currently, valid callback function is passed to check_hba()
+ * by pg_hba_lookup system function to frame the hba tuple row
+ * based on inputs provided by the user.
+ */
+typedef void (*hba_line_callback) (void *context, HbaLine *hba_line,
+											   const char *reason);
+
+/* Context to use with lookup_hba_line_callback function. */
+typedef struct
+{
+	MemoryContext memcxt;
+	TupleDesc	tupdesc;
+	Tuplestorestate *tuple_store;
+}	lookup_hba_line_context;
+
+
+/*
  * pre-parsed content of HBA config file: list of HbaLine structs.
  * parsed_hba_context is the memory context where it lives.
  */
@@ -99,6 +126,10 @@ static List *tokenize_inc_file(List *tokens, const char *outer_filename,
 				  const char *inc_filename);
 static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
 				   int line_num);
+static Datum getauthmethod(UserAuth auth_method);
+static Jsonb *gethba_options(HbaLine *hba);
+static void lookup_hba_line_callback(void *context, HbaLine *hba, const char *reason);
+static bool token_is_a_database_keyword(HbaToken *tok);
 
 /*
  * isblank() exists in the ISO C99 spec, but it's not very portable yet,
@@ -541,6 +572,18 @@ check_db(const char *dbname, const char *role, Oid roleid, List *tokens)
 }
 
 static bool
+token_is_a_database_keyword(HbaToken *tok)
+{
+	if (token_is_keyword(tok, "replication")
+		|| token_is_keyword(tok, "all")
+		|| token_is_keyword(tok, "sameuser")
+		|| token_is_keyword(tok, "samegroup")
+		|| token_is_keyword(tok, "samerole"))
+		return true;
+	return false;
+}
+
+static bool
 ipv4eq(struct sockaddr_in * a, struct sockaddr_in * b)
 {
 	return (a->sin_addr.s_addr == b->sin_addr.s_addr);
@@ -1640,7 +1683,8 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num)
  *	request.
  */
 static void
-check_hba(hbaPort *port)
+check_hba(hbaPort *port, hba_line_callback callback,
+		  void *callback_context)
 {
 	Oid			roleid;
 	ListCell   *line;
@@ -1657,25 +1701,41 @@ check_hba(hbaPort *port)
 		if (hba->conntype == ctLocal)
 		{
 			if (!IS_AF_UNIX(port->raddr.addr.ss_family))
+			{
+				if (callback)
+					callback(callback_context, hba, _("connection type mismatch"));
 				continue;
+			}
 		}
 		else
 		{
 			if (IS_AF_UNIX(port->raddr.addr.ss_family))
+			{
+				if (callback)
+					callback(callback_context, hba, _("connection type mismatch"));
 				continue;
+			}
 
 			/* Check SSL state */
 			if (port->ssl_in_use)
 			{
 				/* Connection is SSL, match both "host" and "hostssl" */
 				if (hba->conntype == ctHostNoSSL)
+				{
+					if (callback)
+						callback(callback_context, hba, _("connection type mismatch"));
 					continue;
+				}
 			}
 			else
 			{
 				/* Connection is not SSL, match both "host" and "hostnossl" */
 				if (hba->conntype == ctHostSSL)
+				{
+					if (callback)
+						callback(callback_context, hba, _("connection type mismatch"));
 					continue;
+				}
 			}
 
 			/* Check IP address */
@@ -1686,14 +1746,22 @@ check_hba(hbaPort *port)
 					{
 						if (!check_hostname(port,
 											hba->hostname))
+						{
+							if (callback)
+								callback(callback_context, hba, _("hostname mismatch"));
 							continue;
+						}
 					}
 					else
 					{
 						if (!check_ip(&port->raddr,
 									  (struct sockaddr *) & hba->addr,
 									  (struct sockaddr *) & hba->mask))
+						{
+							if (callback)
+								callback(callback_context, hba, _("IP address mismatch"));
 							continue;
+						}
 					}
 					break;
 				case ipCmpAll:
@@ -1702,7 +1770,11 @@ check_hba(hbaPort *port)
 				case ipCmpSameNet:
 					if (!check_same_host_or_net(&port->raddr,
 												hba->ip_cmp_method))
+					{
+						if (callback)
+							callback(callback_context, hba, _("samehost/samenet mismatch"));
 						continue;
+					}
 					break;
 				default:
 					/* shouldn't get here, but deem it no-match if so */
@@ -1713,10 +1785,21 @@ check_hba(hbaPort *port)
 		/* Check database and role */
 		if (!check_db(port->database_name, port->user_name, roleid,
 					  hba->databases))
+		{
+			if (callback)
+				callback(callback_context, hba, _("database name mismatch"));
 			continue;
+		}
 
 		if (!check_role(port->user_name, roleid, hba->roles))
+		{
+			if (callback)
+				callback(callback_context, hba, _("user name mismatch"));
 			continue;
+		}
+
+		if (callback)
+			callback(callback_context, hba, NULL);
 
 		/* Found a record that matched! */
 		port->hba = hba;
@@ -1770,8 +1853,7 @@ load_hba(void)
 	FreeFile(file);
 
 	/* Now parse all the lines */
-	Assert(PostmasterContext);
-	hbacxt = AllocSetContextCreate(PostmasterContext,
+	hbacxt = AllocSetContextCreate(CurrentMemoryContext,
 								   "hba parser context",
 								   ALLOCSET_DEFAULT_MINSIZE,
 								   ALLOCSET_DEFAULT_MINSIZE,
@@ -1829,14 +1911,26 @@ load_hba(void)
 	}
 
 	/* Loaded new file successfully, replace the one we use */
-	if (parsed_hba_context != NULL)
-		MemoryContextDelete(parsed_hba_context);
+	discard_hba();
 	parsed_hba_context = hbacxt;
 	parsed_hba_lines = new_parsed_lines;
 
 	return true;
 }
 
+
+void
+discard_hba(void)
+{
+	if (parsed_hba_context != NULL)
+	{
+		MemoryContextDelete(parsed_hba_context);
+		parsed_hba_context = NULL;
+		parsed_hba_lines = NIL;
+	}
+}
+
+
 /*
  * Parse one tokenised line from the ident config file and store the result in
  * an IdentLine structure, or NULL if parsing fails.
@@ -2148,8 +2242,7 @@ load_ident(void)
 	FreeFile(file);
 
 	/* Now parse all the lines */
-	Assert(PostmasterContext);
-	ident_context = AllocSetContextCreate(PostmasterContext,
+	ident_context = AllocSetContextCreate(CurrentMemoryContext,
 										  "ident parser context",
 										  ALLOCSET_DEFAULT_MINSIZE,
 										  ALLOCSET_DEFAULT_MINSIZE,
@@ -2202,6 +2295,20 @@ load_ident(void)
 	}
 
 	/* Loaded new file successfully, replace the one we use */
+	discard_ident();
+	parsed_ident_context = ident_context;
+	parsed_ident_lines = new_parsed_lines;
+
+	return true;
+}
+
+
+void
+discard_ident(void)
+{
+	ListCell   *parsed_line_cell;
+	IdentLine  *newline;
+
 	if (parsed_ident_lines != NIL)
 	{
 		foreach(parsed_line_cell, parsed_ident_lines)
@@ -2210,18 +2317,17 @@ load_ident(void)
 			if (newline->ident_user[0] == '/')
 				pg_regfree(&newline->re);
 		}
+		parsed_ident_lines = NIL;
 	}
+
 	if (parsed_ident_context != NULL)
+	{
 		MemoryContextDelete(parsed_ident_context);
-
-	parsed_ident_context = ident_context;
-	parsed_ident_lines = new_parsed_lines;
-
-	return true;
+		parsed_ident_context = NULL;
+	}
 }
 
 
-
 /*
  *	Determine what authentication method should be used when accessing database
  *	"database" from frontend "raddr", user "user".  Return the method and
@@ -2233,5 +2339,543 @@ load_ident(void)
 void
 hba_getauthmethod(hbaPort *port)
 {
-	check_hba(port);
+	check_hba(port, NULL, NULL);
+}
+
+
+/*
+ * Returns the Text Datum representation of authentication method
+ */
+static Datum
+getauthmethod(UserAuth auth_method)
+{
+	Datum		result;
+
+	switch (auth_method)
+	{
+		case uaReject:
+			result = CStringGetTextDatum("reject");
+			break;
+		case uaTrust:
+			result = CStringGetTextDatum("trust");
+			break;
+		case uaIdent:
+			result = CStringGetTextDatum("ident");
+			break;
+		case uaPassword:
+			result = CStringGetTextDatum("password");
+			break;
+		case uaMD5:
+			result = CStringGetTextDatum("md5");
+			break;
+		case uaGSS:
+			result = CStringGetTextDatum("gss");
+			break;
+		case uaSSPI:
+			result = CStringGetTextDatum("sspi");
+			break;
+		case uaPAM:
+			result = CStringGetTextDatum("pam");
+			break;
+		case uaLDAP:
+			result = CStringGetTextDatum("ldap");
+			break;
+		case uaCert:
+			result = CStringGetTextDatum("cert");
+			break;
+		case uaRADIUS:
+			result = CStringGetTextDatum("radius");
+			break;
+		case uaPeer:
+			result = CStringGetTextDatum("peer");
+			break;
+		default:
+			elog(ERROR, "unexpected authentication method in parsed HBA entry");
+			break;
+	}
+
+	return result;
+}
+
+static Jsonb *
+gethba_options(HbaLine *hba)
+{
+	JsonbParseState *parseState = NULL;
+	JsonbValue *result;
+
+	result = pushJsonbValue(&parseState, WJB_BEGIN_OBJECT, NULL);
+
+	if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
+	{
+		if (hba->include_realm)
+		{
+			push_jsonb_string_key(&parseState, "include_realm");
+			push_jsonb_bool_value(&parseState, true);
+		}
+
+		if (hba->krb_realm)
+		{
+			push_jsonb_string_key(&parseState, "krb_realm");
+			push_jsonb_string_value(&parseState, hba->krb_realm);
+		}
+	}
+
+	if (hba->usermap)
+	{
+		push_jsonb_string_key(&parseState, "map");
+		push_jsonb_string_value(&parseState, hba->usermap);
+	}
+
+	if (hba->clientcert)
+	{
+		push_jsonb_string_key(&parseState, "clientcert");
+		push_jsonb_bool_value(&parseState, true);
+	}
+
+	if (hba->pamservice)
+	{
+		push_jsonb_string_key(&parseState, "pamservice");
+		push_jsonb_string_value(&parseState, hba->pamservice);
+	}
+
+	if (hba->auth_method == uaLDAP)
+	{
+		if (hba->ldapserver)
+		{
+			push_jsonb_string_key(&parseState, "ldapserver");
+			push_jsonb_string_value(&parseState, hba->ldapserver);
+		}
+
+		if (hba->ldapport)
+		{
+			push_jsonb_string_key(&parseState, "ldapport");
+			push_jsonb_int32_value(&parseState, hba->ldapport);
+		}
+
+		if (hba->ldaptls)
+		{
+			push_jsonb_string_key(&parseState, "ldaptls");
+			push_jsonb_bool_value(&parseState, true);
+		}
+
+		if (hba->ldapprefix)
+		{
+			push_jsonb_string_key(&parseState, "ldapprefix");
+			push_jsonb_string_value(&parseState, hba->ldapprefix);
+		}
+
+		if (hba->ldapsuffix)
+		{
+			push_jsonb_string_key(&parseState, "ldapsuffix");
+			push_jsonb_string_value(&parseState, hba->ldapsuffix);
+		}
+
+		if (hba->ldapbasedn)
+		{
+			push_jsonb_string_key(&parseState, "ldapbasedn");
+			push_jsonb_string_value(&parseState, hba->ldapbasedn);
+		}
+
+		if (hba->ldapbinddn)
+		{
+			push_jsonb_string_key(&parseState, "ldapbinddn");
+			push_jsonb_string_value(&parseState, hba->ldapbinddn);
+		}
+
+		if (hba->ldapbindpasswd)
+		{
+			push_jsonb_string_key(&parseState, "ldapbindpasswd");
+			push_jsonb_string_value(&parseState, hba->ldapbindpasswd);
+		}
+
+		if (hba->ldapsearchattribute)
+		{
+			push_jsonb_string_key(&parseState, "ldapsearchattribute");
+			push_jsonb_string_value(&parseState, hba->ldapsearchattribute);
+		}
+
+		if (hba->ldapscope)
+		{
+			push_jsonb_string_key(&parseState, "ldapscope");
+			push_jsonb_int32_value(&parseState, hba->ldapscope);
+		}
+	}
+
+	if (hba->auth_method == uaRADIUS)
+	{
+		if (hba->radiusserver)
+		{
+			push_jsonb_string_key(&parseState, "radiusserver");
+			push_jsonb_string_value(&parseState, hba->radiusserver);
+		}
+
+		if (hba->radiussecret)
+		{
+			push_jsonb_string_key(&parseState, "radiussecret");
+			push_jsonb_string_value(&parseState, hba->radiussecret);
+		}
+
+		if (hba->radiusidentifier)
+		{
+			push_jsonb_string_key(&parseState, "radiusidentifier");
+			push_jsonb_string_value(&parseState, hba->radiusidentifier);
+		}
+
+		if (hba->radiusport)
+		{
+			push_jsonb_string_key(&parseState, "radiusport");
+			push_jsonb_int32_value(&parseState, hba->radiusport);
+		}
+	}
+
+	result = pushJsonbValue(&parseState, WJB_END_OBJECT, NULL);
+	return JsonbValueToJsonb(result);
+}
+
+
+static void
+lookup_hba_line_callback(void *context, HbaLine *hba, const char *reason)
+{
+	Datum		values[NUM_PG_HBA_LOOKUP_ATTS];
+	bool		nulls[NUM_PG_HBA_LOOKUP_ATTS];
+	ListCell   *dbcell;
+	char		buffer[NI_MAXHOST];
+	HeapTuple	tuple;
+	int			index;
+	MemoryContext old_cxt;
+	lookup_hba_line_context *mycxt;
+
+	mycxt = (lookup_hba_line_context *) context;
+
+	index = 0;
+	memset(values, 0, sizeof(values));
+	memset(nulls, 0, sizeof(nulls));
+
+	old_cxt = MemoryContextSwitchTo(mycxt->memcxt);
+
+	/* line_number */
+	values[index] = Int32GetDatum(hba->linenumber);
+
+	/* mode */
+	index++;
+	if (reason == NULL)
+		values[index] = CStringGetTextDatum(_("matched"));
+	else
+		values[index] = CStringGetTextDatum(_("skipped"));
+
+	/* type */
+	index++;
+	switch (hba->conntype)
+	{
+		case ctLocal:
+			values[index] = CStringGetTextDatum("local");
+			break;
+		case ctHost:
+			values[index] = CStringGetTextDatum("host");
+			break;
+		case ctHostSSL:
+			values[index] = CStringGetTextDatum("hostssl");
+			break;
+		case ctHostNoSSL:
+			values[index] = CStringGetTextDatum("hostnossl");
+			break;
+		default:
+			elog(ERROR, "unexpected connection type in parsed HBA entry");
+			break;
+	}
+
+	/* database */
+	index++;
+	if (list_length(hba->databases) != 0)
+	{
+		List	   *names = NULL;
+		List	   *keyword_names = NULL;
+		HbaToken   *tok;
+
+		foreach(dbcell, hba->databases)
+		{
+			tok = lfirst(dbcell);
+			if (token_is_a_database_keyword(tok))
+				keyword_names = lappend(keyword_names, tok->string);
+			else
+				names = lappend(names, tok->string);
+		}
+
+		if (keyword_names != NULL)
+			values[index] = PointerGetDatum(strlist_to_textarray(keyword_names));
+		else
+			nulls[index] = true;
+
+		index++;
+		if (names != NULL)
+			values[index] = PointerGetDatum(strlist_to_textarray(names));
+		else
+			nulls[index] = true;
+	}
+	else
+	{
+		nulls[index] = true;
+		index++;
+		nulls[index] = true;
+	}
+
+	/* user */
+	index++;
+	if (list_length(hba->roles) != 0)
+	{
+		List	   *roles = NULL;
+		List	   *keyword_roles = NULL;
+		HbaToken   *tok;
+
+		foreach(dbcell, hba->roles)
+		{
+			tok = lfirst(dbcell);
+			if (!tok->quoted && strcmp(tok->string, "all") == 0)
+				keyword_roles = lappend(keyword_roles, tok->string);
+			else
+				roles = lappend(roles, tok->string);
+		}
+
+		if (keyword_roles != NULL)
+			values[index] = PointerGetDatum(strlist_to_textarray(keyword_roles));
+		else
+			nulls[index] = true;
+
+		index++;
+		if (roles != NULL)
+			values[index] = PointerGetDatum(strlist_to_textarray(roles));
+		else
+			nulls[index] = true;
+	}
+	else
+	{
+		nulls[index] = true;
+		index++;
+		nulls[index] = true;
+	}
+
+	/* address */
+	index++;
+	if (pg_getnameinfo_all(&hba->addr, sizeof(struct sockaddr_storage),
+						   buffer, sizeof(buffer),
+						   NULL, 0,
+						   NI_NUMERICHOST) == 0)
+	{
+		clean_ipv6_addr(hba->addr.ss_family, buffer);
+		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+	}
+	else
+		nulls[index] = true;
+
+	/* netmask */
+	index++;
+	if (pg_getnameinfo_all(&hba->mask, sizeof(struct sockaddr_storage),
+						   buffer, sizeof(buffer),
+						   NULL, 0,
+						   NI_NUMERICHOST) == 0)
+	{
+		clean_ipv6_addr(hba->mask.ss_family, buffer);
+		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+	}
+	else
+		nulls[index] = true;
+
+	/* hostname */
+	index++;
+	if (hba->hostname)
+		values[index] = CStringGetTextDatum(hba->hostname);
+	else
+		nulls[index] = true;
+
+	/* method */
+	index++;
+	values[index] = getauthmethod(hba->auth_method);
+
+	/* options */
+	index++;
+	values[index] = PointerGetDatum(gethba_options(hba));
+
+	/* reason */
+	index++;
+	if (reason)
+		values[index] = CStringGetTextDatum(reason);
+	else
+		nulls[index] = true;
+
+	tuple = heap_form_tuple(mycxt->tupdesc, values, nulls);
+	tuplestore_puttuple(mycxt->tuple_store, tuple);
+
+	MemoryContextSwitchTo(old_cxt);
+	return;
+}
+
+/*
+ * SQL-accessible SRF to return all the settings from the pg_hba.conf
+ * file.
+ */
+Datum
+pg_hba_lookup(PG_FUNCTION_ARGS)
+{
+	hbaPort    *port;
+	Tuplestorestate *tuple_store;
+	TupleDesc	tupdesc;
+	MemoryContext old_cxt;
+	lookup_hba_line_context *mycxt;
+	ReturnSetInfo *rsi;
+
+	if (!superuser())
+		ereport(ERROR,
+				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+				 (errmsg("must be superuser to view pg_hba.conf settings"))));
+
+	/*
+	 * We must use the Materialize mode to be safe against HBA file reloads
+	 * while the cursor is open. It's also more efficient than having to look
+	 * up our current position in the parsed list every time.
+	 */
+	rsi = (ReturnSetInfo *) fcinfo->resultinfo;
+
+	if (!rsi || !IsA(rsi, ReturnSetInfo) ||
+		(rsi->allowedModes & SFRM_Materialize) == 0)
+		ereport(ERROR,
+				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+				 errmsg("set-valued function called in context that cannot accept a set")));
+
+	port = palloc0(sizeof(hbaPort));
+
+	if (PG_ARGISNULL(0))
+		ereport(ERROR,
+				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+				 (errmsg("database name is required to match pg_hba configuration entry"))));
+	else
+		port->database_name = TextDatumGetCString(PG_GETARG_DATUM(0));
+
+	if (PG_ARGISNULL(1))
+		ereport(ERROR,
+				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+				 (errmsg("user name is required to match pg_hba configuration entry"))));
+	else
+		port->user_name = TextDatumGetCString(PG_GETARG_DATUM(1));
+
+
+	if (!PG_ARGISNULL(2))
+	{
+		char	   *address = NULL;
+		struct addrinfo *gai_result = NULL;
+		struct addrinfo hints;
+		int			ret;
+
+		address = TextDatumGetCString(PG_GETARG_DATUM(2));
+
+		/* Get the IP address either way */
+		hints.ai_flags = AI_NUMERICHOST;
+		hints.ai_family = AF_UNSPEC;
+		hints.ai_socktype = 0;
+		hints.ai_protocol = 0;
+		hints.ai_addrlen = 0;
+		hints.ai_canonname = NULL;
+		hints.ai_addr = NULL;
+		hints.ai_next = NULL;
+
+		ret = getaddrinfo(address, NULL, &hints, &gai_result);
+		if (ret == 0 && gai_result)
+			memcpy(&port->raddr.addr, gai_result->ai_addr, gai_result->ai_addrlen);
+		else if (ret == EAI_NONAME)
+		{
+			struct addrinfo *gai_result2 = NULL;
+
+			port->remote_hostname = pstrdup(address);
+
+			ret = getaddrinfo(port->remote_hostname, NULL, NULL, &gai_result2);
+			if (ret == 0 && gai_result2)
+				memcpy(&port->raddr.addr, gai_result2->ai_addr, gai_result2->ai_addrlen);
+			else
+				ereport(ERROR,
+				(errmsg("getaddrinfo failed to look into hostname \"%s\": %s",
+						port->remote_hostname, gai_strerror(ret))));
+
+			if (gai_result2)
+				freeaddrinfo(gai_result2);
+		}
+		else
+			ereport(ERROR,
+					(errmsg("invalid IP address \"%s\": %s",
+							address, gai_strerror(ret))));
+		if (gai_result)
+			freeaddrinfo(gai_result);
+	}
+	else
+		port->raddr.addr.ss_family = AF_UNIX;
+
+	port->ssl_in_use = DatumGetBool(PG_GETARG_DATUM(3));
+
+	rsi->returnMode = SFRM_Materialize;
+
+	if (!load_hba())
+		ereport(ERROR,
+				(errmsg("failed to load pg_hba.conf file"),
+			   errhint("more details may be available in the server log.")));
+
+	/*
+	 * Create the tupledesc and tuplestore in the per_query context as
+	 * required for SFRM_Materialize.
+	 */
+	old_cxt = MemoryContextSwitchTo(rsi->econtext->ecxt_per_query_memory);
+
+	tupdesc = CreateTemplateTupleDesc(NUM_PG_HBA_LOOKUP_ATTS, false);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 1, "line_number",
+					   INT4OID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 2, "mode",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 3, "type",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 4, "keyword_database",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 5, "database",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 6, "keyword_user",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 7, "user_name",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 8, "address",
+					   INETOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 9, "netmask",
+					   INETOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 10, "hostname",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 11, "method",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 12, "options",
+					   JSONBOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 13, "reason",
+					   TEXTOID, -1, 0);
+	BlessTupleDesc(tupdesc);
+
+	tuple_store =
+		tuplestore_begin_heap(rsi->allowedModes & SFRM_Materialize_Random,
+							  false, work_mem);
+
+	MemoryContextSwitchTo(old_cxt);
+
+	mycxt = (lookup_hba_line_context *) palloc(sizeof(lookup_hba_line_context));
+	mycxt->memcxt = AllocSetContextCreate(CurrentMemoryContext,
+										  "pg_hba_lookup tuple cxt",
+										  ALLOCSET_DEFAULT_MINSIZE,
+										  ALLOCSET_DEFAULT_INITSIZE,
+										  ALLOCSET_DEFAULT_MAXSIZE);
+	mycxt->tupdesc = tupdesc;
+	mycxt->tuple_store = tuple_store;
+
+	check_hba(port, lookup_hba_line_callback, mycxt);
+
+	MemoryContextDelete(mycxt->memcxt);
+	pfree(mycxt);
+
+	/* Clean up the memory allocated by load_hba() explicitly. */
+	discard_hba();
+
+	rsi->setDesc = tupdesc;
+	rsi->setResult = tuple_store;
+
+	PG_RETURN_NULL();
 }
diff --git a/src/backend/utils/adt/jsonb_util.c b/src/backend/utils/adt/jsonb_util.c
index e1ceea6..171e532 100644
--- a/src/backend/utils/adt/jsonb_util.c
+++ b/src/backend/utils/adt/jsonb_util.c
@@ -1802,3 +1802,49 @@ uniqueifyJsonbObject(JsonbValue *object)
 		object->val.object.nPairs = res + 1 - object->val.object.pairs;
 	}
 }
+
+void
+push_jsonb_string_key(JsonbParseState **pstate, char *string_key)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvString;
+	jb.val.string.len = strlen(string_key);
+	jb.val.string.val = pstrdup(string_key);
+	pushJsonbValue(pstate, WJB_KEY, &jb);
+}
+
+void
+push_jsonb_bool_value(JsonbParseState **pstate, bool bool_val)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvBool;
+	jb.val.boolean = bool_val;
+
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
+
+void
+push_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val)
+{
+	JsonbValue	jb;
+	char		outputstr[64];
+
+	snprintf(outputstr, 64, "%d", int32_val);
+	jb.type = jbvNumeric;
+	jb.val.numeric = DatumGetNumeric(DirectFunctionCall3(numeric_in, CStringGetDatum(outputstr), 0, -1));
+
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
+
+void
+push_jsonb_string_value(JsonbParseState **pstate, char *string_value)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvString;
+	jb.val.string.len = strlen(string_value);
+	jb.val.string.val = pstrdup(string_value);
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c
index b3f1bc4..a027fbe 100644
--- a/src/backend/utils/init/postinit.c
+++ b/src/backend/utils/init/postinit.c
@@ -192,18 +192,6 @@ PerformAuthentication(Port *port)
 	 * FIXME: [fork/exec] Ugh.  Is there a way around this overhead?
 	 */
 #ifdef EXEC_BACKEND
-	/*
-	 * load_hba() and load_ident() want to work within the PostmasterContext,
-	 * so create that if it doesn't exist (which it won't).  We'll delete it
-	 * again later, in PostgresMain.
-	 */
-	if (PostmasterContext == NULL)
-		PostmasterContext = AllocSetContextCreate(TopMemoryContext,
-												  "Postmaster",
-												  ALLOCSET_DEFAULT_MINSIZE,
-												  ALLOCSET_DEFAULT_INITSIZE,
-												  ALLOCSET_DEFAULT_MAXSIZE);
-
 	if (!load_hba())
 	{
 		/*
@@ -739,6 +727,14 @@ InitPostgres(const char *in_dbname, Oid dboid, const char *username,
 	}
 
 	/*
+	 * We don't need the HBA and ident data going forward, but we can't rely
+	 * on release of PostmasterContext to clean that up, so discard them
+	 * explicitly here.
+	 */
+	discard_hba();
+	discard_ident();
+
+	/*
 	 * If we're trying to shut down, only superusers can connect, and new
 	 * replication connections are not allowed.
 	 */
diff --git a/src/include/catalog/pg_proc.h b/src/include/catalog/pg_proc.h
index ceb8129..fd32c3e 100644
--- a/src/include/catalog/pg_proc.h
+++ b/src/include/catalog/pg_proc.h
@@ -3014,6 +3014,8 @@ DATA(insert OID = 2084 (  pg_show_all_settings	PGNSP PGUID 12 1 1000 0 0 f f f f
 DESCR("SHOW ALL as a function");
 DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
 DESCR("show config file settings");
+DATA(insert OID = 3997 (  pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f f t v u 4 0 2249 "25 25 25 16" "{25,25,25,16,23,25,25,1009,1009,1009,1009,869,869,25,25,3802,25}" "{i,i,i,i,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{database,user_name,address,ssl_inuse,line_number,mode,type,keyword_database,database,keyword_user,user_name,address,netmask,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+DESCR("view client authentication settings");
 DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
 DESCR("view system lock information");
 DATA(insert OID = 2561 (  pg_blocking_pids PGNSP PGUID 12 1 0 0 0 f f f f t f v s 1 0 1007 "23" _null_ _null_ _null_ _null_ _null_ pg_blocking_pids _null_ _null_ _null_ ));
diff --git a/src/include/libpq/hba.h b/src/include/libpq/hba.h
index 68a953a..291300b 100644
--- a/src/include/libpq/hba.h
+++ b/src/include/libpq/hba.h
@@ -98,6 +98,10 @@ typedef struct Port hbaPort;
 
 extern bool load_hba(void);
 extern bool load_ident(void);
+
+extern void discard_hba(void);
+extern void discard_ident(void);
+
 extern void hba_getauthmethod(hbaPort *port);
 extern int check_usermap(const char *usermap_name,
 			  const char *pg_role, const char *auth_user,
diff --git a/src/include/utils/builtins.h b/src/include/utils/builtins.h
index 59a00bb..4f0f31d 100644
--- a/src/include/utils/builtins.h
+++ b/src/include/utils/builtins.h
@@ -1158,6 +1158,9 @@ extern Datum pg_control_system(PG_FUNCTION_ARGS);
 extern Datum pg_control_init(PG_FUNCTION_ARGS);
 extern Datum pg_control_recovery(PG_FUNCTION_ARGS);
 
+/* hba.c */
+extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
+
 /* rls.c */
 extern Datum row_security_active(PG_FUNCTION_ARGS);
 extern Datum row_security_active_name(PG_FUNCTION_ARGS);
diff --git a/src/include/utils/jsonb.h b/src/include/utils/jsonb.h
index 5f49d8d..33e00d2 100644
--- a/src/include/utils/jsonb.h
+++ b/src/include/utils/jsonb.h
@@ -427,6 +427,12 @@ extern bool JsonbDeepContains(JsonbIterator **val,
 				  JsonbIterator **mContained);
 extern void JsonbHashScalarValue(const JsonbValue *scalarVal, uint32 *hash);
 
+/* jsonb_util.c support functions */
+void push_jsonb_string_key(JsonbParseState **pstate, char *string_key);
+void push_jsonb_bool_value(JsonbParseState **pstate, bool bool_val);
+void push_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val);
+void push_jsonb_string_value(JsonbParseState **pstate, char *string_value);
+
 /* jsonb.c support functions */
 extern char *JsonbToCString(StringInfo out, JsonbContainer *in,
 			   int estimated_len);

diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml
index ae93e69..b286681 100644
--- a/doc/src/sgml/func.sgml
+++ b/doc/src/sgml/func.sgml
@@ -17220,6 +17220,19 @@ SELECT collation for ('foo' COLLATE "de_DE");
        <entry><type>text</type></entry>
        <entry>set parameter and return new value</entry>
       </row>
+      <row>
+       <entry>
+        <indexterm>
+         <primary>pg_hba_lookup</primary>
+        </indexterm>
+        <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+                            <parameter>user_name</> <type>text</>
+                            [, <parameter>address</> <type>text</>]
+                            [, <parameter>ssl_inuse</> <type>text</>)</function></literal>
+       </entry>
+       <entry><type>record</type></entry>
+       <entry>scan <filename>pg_hba.conf</> and return examined entries up to a matching one</entry>
+      </row>
      </tbody>
     </tgroup>
    </table>
@@ -17277,6 +17290,32 @@ SELECT set_config('log_statement_stats', 'off', false);
 </programlisting>
    </para>
 
+   <para>
+    <function>pg_hba_lookup</function> returns a set of records containing the
+    line number, mode, type, database, user_name, address, netmask, hostname,
+    method, options and skip reason. For example, to debug problems with user
+    <literal>kommih</> trying to connect to a database <literal>postgres</>
+    from IPv6-address <literal>::1</>, one can issue a following query:
+<programlisting>
+postgres=# select * from pg_hba_lookup('postgres', 'kommih', '::1');
+ line_number |  mode   | type  | keyword_database | database | keyword_user | user_name | keyword_address |  address  |                 netmask                 | hostname | method | options |          reason          
+-------------+---------+-------+------------------+----------+--------------+-----------+-----------------+-----------+-----------------------------------------+----------+--------+---------+--------------------------
+          84 | skipped | local | {all}            |          | {all}        |           |                 |           |                                         |          | trust  | {}      | connection type mismatch
+          86 | skipped | host  | {all}            |          | {all}        |           |                 | 127.0.0.1 | 255.255.255.255                         |          | trust  | {}      | IP address mismatch
+          90 | matched | host  | {all}            |          | {all}        |           |                 | ::1       | ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff |          | trust  | {}      | 
+(3 rows)
+
+</programlisting>
+    This function actually loads the contents of <filename>pg_hba.conf</> file
+    into memory to perform matching, thus a database administrator can use it
+    to test the effects of changes made to the file in isolation prior to
+    actually applying the configuration cluster-wide with a signal to the
+    postmaster process.
+
+    Only superusers can access this function to look the
+    <filename>pg_hba.conf</> entries up.
+   </para>
+   
   </sect2>
 
   <sect2 id="functions-admin-signal">
diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql
index 9ae1ef4..eff567c 100644
--- a/src/backend/catalog/system_views.sql
+++ b/src/backend/catalog/system_views.sql
@@ -997,3 +997,13 @@ RETURNS text[]
 LANGUAGE INTERNAL
 STRICT IMMUTABLE
 AS 'parse_ident';
+
+CREATE OR REPLACE FUNCTION pg_hba_lookup(IN database text, IN user_name text,
+    IN address text DEFAULT NULL, IN ssl_inuse boolean DEFAULT false,
+    OUT line_number int, OUT mode text, OUT type text, OUT keyword_database text[],
+    OUT database text[], OUT keyword_user text[], OUT user_name text[],
+    OUT keyword_address text, OUT address inet, OUT netmask inet, OUT hostname text,
+    OUT method text, OUT options jsonb, OUT reason text)
+RETURNS SETOF RECORD
+LANGUAGE INTERNAL
+AS 'pg_hba_lookup';
diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index 28f9fb5..81ddac9 100644
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -25,15 +25,22 @@
 #include <arpa/inet.h>
 #include <unistd.h>
 
+#include "access/htup_details.h"
+#include "catalog/objectaddress.h"
 #include "catalog/pg_collation.h"
+#include "catalog/pg_type.h"
+#include "funcapi.h"
 #include "libpq/ip.h"
 #include "libpq/libpq.h"
+#include "miscadmin.h"
 #include "postmaster/postmaster.h"
 #include "regex/regex.h"
 #include "replication/walsender.h"
 #include "storage/fd.h"
 #include "utils/acl.h"
+#include "utils/builtins.h"
 #include "utils/guc.h"
+#include "utils/jsonb.h"
 #include "utils/lsyscache.h"
 #include "utils/memutils.h"
 
@@ -52,6 +59,8 @@
 #define MAX_TOKEN	256
 #define MAX_LINE	8192
 
+#define NUM_PG_HBA_LOOKUP_ATTS	 14
+
 /* callback data for check_network_callback */
 typedef struct check_network_data
 {
@@ -75,6 +84,23 @@ typedef struct HbaToken
 } HbaToken;
 
 /*
+ * Optional callback function type for check_hba() function.
+ * Currently, valid callback function is passed to check_hba()
+ * by pg_hba_lookup system function to frame the hba tuple row
+ * based on inputs provided by the user.
+ */
+typedef void (*hba_line_callback) (void *context, HbaLine *hba_line,
+											   const char *reason);
+
+/* Context to use with lookup_hba_line_callback function. */
+typedef struct lookup_hba_line_context
+{
+	MemoryContext memcxt;
+	TupleDesc	tupdesc;
+	Tuplestorestate *tuple_store;
+} lookup_hba_line_context;
+
+/*
  * pre-parsed content of HBA config file: list of HbaLine structs.
  * parsed_hba_context is the memory context where it lives.
  */
@@ -99,6 +125,10 @@ static List *tokenize_inc_file(List *tokens, const char *outer_filename,
 				  const char *inc_filename);
 static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
 				   int line_num);
+static Datum getauthmethod(UserAuth auth_method);
+static Jsonb *gethba_options(HbaLine *hba);
+static void lookup_hba_line_callback(void *context, HbaLine *hba, const char *reason);
+static bool token_is_a_database_keyword(HbaToken *tok);
 
 /*
  * isblank() exists in the ISO C99 spec, but it's not very portable yet,
@@ -541,6 +571,18 @@ check_db(const char *dbname, const char *role, Oid roleid, List *tokens)
 }
 
 static bool
+token_is_a_database_keyword(HbaToken *tok)
+{
+	if (token_is_keyword(tok, "replication")
+		|| token_is_keyword(tok, "all")
+		|| token_is_keyword(tok, "sameuser")
+		|| token_is_keyword(tok, "samegroup")
+		|| token_is_keyword(tok, "samerole"))
+		return true;
+	return false;
+}
+
+static bool
 ipv4eq(struct sockaddr_in * a, struct sockaddr_in * b)
 {
 	return (a->sin_addr.s_addr == b->sin_addr.s_addr);
@@ -1640,7 +1682,8 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num)
  *	request.
  */
 static void
-check_hba(hbaPort *port)
+check_hba(hbaPort *port, hba_line_callback callback,
+		  void *callback_context)
 {
 	Oid			roleid;
 	ListCell   *line;
@@ -1657,25 +1700,41 @@ check_hba(hbaPort *port)
 		if (hba->conntype == ctLocal)
 		{
 			if (!IS_AF_UNIX(port->raddr.addr.ss_family))
+			{
+				if (callback)
+					callback(callback_context, hba, _("connection type mismatch"));
 				continue;
+			}
 		}
 		else
 		{
 			if (IS_AF_UNIX(port->raddr.addr.ss_family))
+			{
+				if (callback)
+					callback(callback_context, hba, _("connection type mismatch"));
 				continue;
+			}
 
 			/* Check SSL state */
 			if (port->ssl_in_use)
 			{
 				/* Connection is SSL, match both "host" and "hostssl" */
 				if (hba->conntype == ctHostNoSSL)
+				{
+					if (callback)
+						callback(callback_context, hba, _("connection type mismatch"));
 					continue;
+				}
 			}
 			else
 			{
 				/* Connection is not SSL, match both "host" and "hostnossl" */
 				if (hba->conntype == ctHostSSL)
+				{
+					if (callback)
+						callback(callback_context, hba, _("connection type mismatch"));
 					continue;
+				}
 			}
 
 			/* Check IP address */
@@ -1686,14 +1745,22 @@ check_hba(hbaPort *port)
 					{
 						if (!check_hostname(port,
 											hba->hostname))
+						{
+							if (callback)
+								callback(callback_context, hba, _("hostname mismatch"));
 							continue;
+						}
 					}
 					else
 					{
 						if (!check_ip(&port->raddr,
 									  (struct sockaddr *) & hba->addr,
 									  (struct sockaddr *) & hba->mask))
+						{
+							if (callback)
+								callback(callback_context, hba, _("IP address mismatch"));
 							continue;
+						}
 					}
 					break;
 				case ipCmpAll:
@@ -1702,7 +1769,11 @@ check_hba(hbaPort *port)
 				case ipCmpSameNet:
 					if (!check_same_host_or_net(&port->raddr,
 												hba->ip_cmp_method))
+					{
+						if (callback)
+							callback(callback_context, hba, _("samehost/samenet mismatch"));
 						continue;
+					}
 					break;
 				default:
 					/* shouldn't get here, but deem it no-match if so */
@@ -1713,10 +1784,21 @@ check_hba(hbaPort *port)
 		/* Check database and role */
 		if (!check_db(port->database_name, port->user_name, roleid,
 					  hba->databases))
+		{
+			if (callback)
+				callback(callback_context, hba, _("database name mismatch"));
 			continue;
+		}
 
 		if (!check_role(port->user_name, roleid, hba->roles))
+		{
+			if (callback)
+				callback(callback_context, hba, _("user name mismatch"));
 			continue;
+		}
+
+		if (callback)
+			callback(callback_context, hba, NULL);
 
 		/* Found a record that matched! */
 		port->hba = hba;
@@ -1770,8 +1852,7 @@ load_hba(void)
 	FreeFile(file);
 
 	/* Now parse all the lines */
-	Assert(PostmasterContext);
-	hbacxt = AllocSetContextCreate(PostmasterContext,
+	hbacxt = AllocSetContextCreate(CurrentMemoryContext,
 								   "hba parser context",
 								   ALLOCSET_DEFAULT_MINSIZE,
 								   ALLOCSET_DEFAULT_MINSIZE,
@@ -1829,14 +1910,26 @@ load_hba(void)
 	}
 
 	/* Loaded new file successfully, replace the one we use */
-	if (parsed_hba_context != NULL)
-		MemoryContextDelete(parsed_hba_context);
+	discard_hba();
 	parsed_hba_context = hbacxt;
 	parsed_hba_lines = new_parsed_lines;
 
 	return true;
 }
 
+
+void
+discard_hba(void)
+{
+	if (parsed_hba_context != NULL)
+	{
+		MemoryContextDelete(parsed_hba_context);
+		parsed_hba_context = NULL;
+		parsed_hba_lines = NIL;
+	}
+}
+
+
 /*
  * Parse one tokenised line from the ident config file and store the result in
  * an IdentLine structure, or NULL if parsing fails.
@@ -2148,8 +2241,7 @@ load_ident(void)
 	FreeFile(file);
 
 	/* Now parse all the lines */
-	Assert(PostmasterContext);
-	ident_context = AllocSetContextCreate(PostmasterContext,
+	ident_context = AllocSetContextCreate(CurrentMemoryContext,
 										  "ident parser context",
 										  ALLOCSET_DEFAULT_MINSIZE,
 										  ALLOCSET_DEFAULT_MINSIZE,
@@ -2202,6 +2294,20 @@ load_ident(void)
 	}
 
 	/* Loaded new file successfully, replace the one we use */
+	discard_ident();
+	parsed_ident_context = ident_context;
+	parsed_ident_lines = new_parsed_lines;
+
+	return true;
+}
+
+
+void
+discard_ident(void)
+{
+	ListCell   *parsed_line_cell;
+	IdentLine  *newline;
+
 	if (parsed_ident_lines != NIL)
 	{
 		foreach(parsed_line_cell, parsed_ident_lines)
@@ -2210,18 +2316,17 @@ load_ident(void)
 			if (newline->ident_user[0] == '/')
 				pg_regfree(&newline->re);
 		}
+		parsed_ident_lines = NIL;
 	}
+
 	if (parsed_ident_context != NULL)
+	{
 		MemoryContextDelete(parsed_ident_context);
-
-	parsed_ident_context = ident_context;
-	parsed_ident_lines = new_parsed_lines;
-
-	return true;
+		parsed_ident_context = NULL;
+	}
 }
 
 
-
 /*
  *	Determine what authentication method should be used when accessing database
  *	"database" from frontend "raddr", user "user".  Return the method and
@@ -2233,5 +2338,567 @@ load_ident(void)
 void
 hba_getauthmethod(hbaPort *port)
 {
-	check_hba(port);
+	check_hba(port, NULL, NULL);
+}
+
+
+/*
+ * Returns the Text Datum representation of authentication method
+ */
+static Datum
+getauthmethod(UserAuth auth_method)
+{
+	Datum		result;
+
+	switch (auth_method)
+	{
+		case uaReject:
+			result = CStringGetTextDatum("reject");
+			break;
+		case uaTrust:
+			result = CStringGetTextDatum("trust");
+			break;
+		case uaIdent:
+			result = CStringGetTextDatum("ident");
+			break;
+		case uaPassword:
+			result = CStringGetTextDatum("password");
+			break;
+		case uaMD5:
+			result = CStringGetTextDatum("md5");
+			break;
+		case uaGSS:
+			result = CStringGetTextDatum("gss");
+			break;
+		case uaSSPI:
+			result = CStringGetTextDatum("sspi");
+			break;
+		case uaPAM:
+			result = CStringGetTextDatum("pam");
+			break;
+		case uaLDAP:
+			result = CStringGetTextDatum("ldap");
+			break;
+		case uaCert:
+			result = CStringGetTextDatum("cert");
+			break;
+		case uaRADIUS:
+			result = CStringGetTextDatum("radius");
+			break;
+		case uaPeer:
+			result = CStringGetTextDatum("peer");
+			break;
+		default:
+			elog(ERROR, "unexpected authentication method in parsed HBA entry");
+			break;
+	}
+
+	return result;
+}
+
+static Jsonb *
+gethba_options(HbaLine *hba)
+{
+	JsonbParseState *parseState = NULL;
+	JsonbValue *result;
+
+	result = pushJsonbValue(&parseState, WJB_BEGIN_OBJECT, NULL);
+
+	if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
+	{
+		if (hba->include_realm)
+		{
+			push_jsonb_string_key(&parseState, "include_realm");
+			push_jsonb_bool_value(&parseState, true);
+		}
+
+		if (hba->krb_realm)
+		{
+			push_jsonb_string_key(&parseState, "krb_realm");
+			push_jsonb_string_value(&parseState, hba->krb_realm);
+		}
+	}
+
+	if (hba->usermap)
+	{
+		push_jsonb_string_key(&parseState, "map");
+		push_jsonb_string_value(&parseState, hba->usermap);
+	}
+
+	if (hba->clientcert)
+	{
+		push_jsonb_string_key(&parseState, "clientcert");
+		push_jsonb_bool_value(&parseState, true);
+	}
+
+	if (hba->pamservice)
+	{
+		push_jsonb_string_key(&parseState, "pamservice");
+		push_jsonb_string_value(&parseState, hba->pamservice);
+	}
+
+	if (hba->auth_method == uaLDAP)
+	{
+		if (hba->ldapserver)
+		{
+			push_jsonb_string_key(&parseState, "ldapserver");
+			push_jsonb_string_value(&parseState, hba->ldapserver);
+		}
+
+		if (hba->ldapport)
+		{
+			push_jsonb_string_key(&parseState, "ldapport");
+			push_jsonb_int32_value(&parseState, hba->ldapport);
+		}
+
+		if (hba->ldaptls)
+		{
+			push_jsonb_string_key(&parseState, "ldaptls");
+			push_jsonb_bool_value(&parseState, true);
+		}
+
+		if (hba->ldapprefix)
+		{
+			push_jsonb_string_key(&parseState, "ldapprefix");
+			push_jsonb_string_value(&parseState, hba->ldapprefix);
+		}
+
+		if (hba->ldapsuffix)
+		{
+			push_jsonb_string_key(&parseState, "ldapsuffix");
+			push_jsonb_string_value(&parseState, hba->ldapsuffix);
+		}
+
+		if (hba->ldapbasedn)
+		{
+			push_jsonb_string_key(&parseState, "ldapbasedn");
+			push_jsonb_string_value(&parseState, hba->ldapbasedn);
+		}
+
+		if (hba->ldapbinddn)
+		{
+			push_jsonb_string_key(&parseState, "ldapbinddn");
+			push_jsonb_string_value(&parseState, hba->ldapbinddn);
+		}
+
+		if (hba->ldapbindpasswd)
+		{
+			push_jsonb_string_key(&parseState, "ldapbindpasswd");
+			push_jsonb_string_value(&parseState, hba->ldapbindpasswd);
+		}
+
+		if (hba->ldapsearchattribute)
+		{
+			push_jsonb_string_key(&parseState, "ldapsearchattribute");
+			push_jsonb_string_value(&parseState, hba->ldapsearchattribute);
+		}
+
+		if (hba->ldapscope)
+		{
+			push_jsonb_string_key(&parseState, "ldapscope");
+			push_jsonb_int32_value(&parseState, hba->ldapscope);
+		}
+	}
+
+	if (hba->auth_method == uaRADIUS)
+	{
+		if (hba->radiusserver)
+		{
+			push_jsonb_string_key(&parseState, "radiusserver");
+			push_jsonb_string_value(&parseState, hba->radiusserver);
+		}
+
+		if (hba->radiussecret)
+		{
+			push_jsonb_string_key(&parseState, "radiussecret");
+			push_jsonb_string_value(&parseState, hba->radiussecret);
+		}
+
+		if (hba->radiusidentifier)
+		{
+			push_jsonb_string_key(&parseState, "radiusidentifier");
+			push_jsonb_string_value(&parseState, hba->radiusidentifier);
+		}
+
+		if (hba->radiusport)
+		{
+			push_jsonb_string_key(&parseState, "radiusport");
+			push_jsonb_int32_value(&parseState, hba->radiusport);
+		}
+	}
+
+	result = pushJsonbValue(&parseState, WJB_END_OBJECT, NULL);
+	return JsonbValueToJsonb(result);
+}
+
+
+static void
+lookup_hba_line_callback(void *context, HbaLine *hba, const char *reason)
+{
+	Datum		values[NUM_PG_HBA_LOOKUP_ATTS];
+	bool		nulls[NUM_PG_HBA_LOOKUP_ATTS];
+	ListCell   *dbcell;
+	char		buffer[NI_MAXHOST];
+	HeapTuple	tuple;
+	int			index;
+	MemoryContext old_cxt;
+	lookup_hba_line_context *mycxt;
+
+	mycxt = (lookup_hba_line_context *) context;
+
+	index = 0;
+	memset(values, 0, sizeof(values));
+	memset(nulls, 0, sizeof(nulls));
+
+	old_cxt = MemoryContextSwitchTo(mycxt->memcxt);
+
+	/* line_number */
+	values[index] = Int32GetDatum(hba->linenumber);
+
+	/* mode */
+	index++;
+	if (reason == NULL)
+		values[index] = CStringGetTextDatum(_("matched"));
+	else
+		values[index] = CStringGetTextDatum(_("skipped"));
+
+	/* type */
+	index++;
+	switch (hba->conntype)
+	{
+		case ctLocal:
+			values[index] = CStringGetTextDatum("local");
+			break;
+		case ctHost:
+			values[index] = CStringGetTextDatum("host");
+			break;
+		case ctHostSSL:
+			values[index] = CStringGetTextDatum("hostssl");
+			break;
+		case ctHostNoSSL:
+			values[index] = CStringGetTextDatum("hostnossl");
+			break;
+		default:
+			elog(ERROR, "unexpected connection type in parsed HBA entry");
+			break;
+	}
+
+	/* keyword_database and database */
+	index++;
+	if (list_length(hba->databases) != 0)
+	{
+		List	   *names = NULL;
+		List	   *keyword_names = NULL;
+		HbaToken   *tok;
+
+		foreach(dbcell, hba->databases)
+		{
+			tok = lfirst(dbcell);
+			if (token_is_a_database_keyword(tok))
+				keyword_names = lappend(keyword_names, tok->string);
+			else
+				names = lappend(names, tok->string);
+		}
+
+		/* keyword_database */
+		if (keyword_names != NULL)
+			values[index] = PointerGetDatum(strlist_to_textarray(keyword_names));
+		else
+			nulls[index] = true;
+
+		/* database */
+		index++;
+		if (names != NULL)
+			values[index] = PointerGetDatum(strlist_to_textarray(names));
+		else
+			nulls[index] = true;
+	}
+	else
+	{
+		nulls[index] = true;
+		index++;
+		nulls[index] = true;
+	}
+
+	/* keyword_user and user */
+	index++;
+	if (list_length(hba->roles) != 0)
+	{
+		List	   *roles = NULL;
+		List	   *keyword_roles = NULL;
+		HbaToken   *tok;
+
+		foreach(dbcell, hba->roles)
+		{
+			tok = lfirst(dbcell);
+			if (token_is_keyword(tok, "all"))
+				keyword_roles = lappend(keyword_roles, tok->string);
+			else
+				roles = lappend(roles, tok->string);
+		}
+
+		/* keyword_user */
+		if (keyword_roles != NULL)
+			values[index] = PointerGetDatum(strlist_to_textarray(keyword_roles));
+		else
+			nulls[index] = true;
+
+		/* user */
+		index++;
+		if (roles != NULL)
+			values[index] = PointerGetDatum(strlist_to_textarray(roles));
+		else
+			nulls[index] = true;
+	}
+	else
+	{
+		nulls[index] = true;
+		index++;
+		nulls[index] = true;
+	}
+
+	/* keyword_address */
+	index++;
+	switch (hba->ip_cmp_method)
+	{
+		case ipCmpAll:
+			values[index] = CStringGetTextDatum("all");
+			break;
+		case ipCmpSameHost:
+			values[index] = CStringGetTextDatum("samehost");
+			break;
+		case ipCmpSameNet:
+			values[index] = CStringGetTextDatum("samenet");
+			break;
+		default:
+			nulls[index] = true;
+			break;
+	}
+
+	/* address */
+	index++;
+	if (pg_getnameinfo_all(&hba->addr, sizeof(struct sockaddr_storage),
+						   buffer, sizeof(buffer),
+						   NULL, 0,
+						   NI_NUMERICHOST) == 0)
+	{
+		clean_ipv6_addr(hba->addr.ss_family, buffer);
+		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+	}
+	else
+		nulls[index] = true;
+
+	/* netmask */
+	index++;
+	if (pg_getnameinfo_all(&hba->mask, sizeof(struct sockaddr_storage),
+						   buffer, sizeof(buffer),
+						   NULL, 0,
+						   NI_NUMERICHOST) == 0)
+	{
+		clean_ipv6_addr(hba->mask.ss_family, buffer);
+		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+	}
+	else
+		nulls[index] = true;
+
+	/* hostname */
+	index++;
+	if (hba->hostname)
+		values[index] = CStringGetTextDatum(hba->hostname);
+	else
+		nulls[index] = true;
+
+	/* method */
+	index++;
+	values[index] = getauthmethod(hba->auth_method);
+
+	/* options */
+	index++;
+	values[index] = PointerGetDatum(gethba_options(hba));
+
+	/* reason */
+	index++;
+	if (reason)
+		values[index] = CStringGetTextDatum(reason);
+	else
+		nulls[index] = true;
+
+	tuple = heap_form_tuple(mycxt->tupdesc, values, nulls);
+	tuplestore_puttuple(mycxt->tuple_store, tuple);
+
+	MemoryContextSwitchTo(old_cxt);
+	return;
+}
+
+/*
+ * SQL-accessible SRF to return all the settings from the pg_hba.conf
+ * file.
+ */
+Datum
+pg_hba_lookup(PG_FUNCTION_ARGS)
+{
+	hbaPort    *port;
+	Tuplestorestate *tuple_store;
+	TupleDesc	tupdesc;
+	MemoryContext old_cxt;
+	lookup_hba_line_context *mycxt;
+	ReturnSetInfo *rsi;
+
+	if (!superuser())
+		ereport(ERROR,
+				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+				 (errmsg("must be superuser to view pg_hba.conf settings"))));
+
+	/*
+	 * We must use the Materialize mode to be safe against HBA file reloads
+	 * while the cursor is open. It's also more efficient than having to look
+	 * up our current position in the parsed list every time.
+	 */
+	rsi = (ReturnSetInfo *) fcinfo->resultinfo;
+
+	if (!rsi || !IsA(rsi, ReturnSetInfo) ||
+		(rsi->allowedModes & SFRM_Materialize) == 0)
+		ereport(ERROR,
+				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+				 errmsg("set-valued function called in context that cannot accept a set")));
+
+	port = palloc0(sizeof(hbaPort));
+
+	if (PG_ARGISNULL(0))
+		ereport(ERROR,
+				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+				 (errmsg("database name is required to match pg_hba configuration entry"))));
+	else
+		port->database_name = TextDatumGetCString(PG_GETARG_DATUM(0));
+
+	if (PG_ARGISNULL(1))
+		ereport(ERROR,
+				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+				 (errmsg("user name is required to match pg_hba configuration entry"))));
+	else
+		port->user_name = TextDatumGetCString(PG_GETARG_DATUM(1));
+
+
+	if (!PG_ARGISNULL(2))
+	{
+		char	   *address = NULL;
+		struct addrinfo *gai_result = NULL;
+		struct addrinfo hints;
+		int			ret;
+
+		address = TextDatumGetCString(PG_GETARG_DATUM(2));
+
+		/* Get the IP address either way */
+		hints.ai_flags = AI_NUMERICHOST;
+		hints.ai_family = AF_UNSPEC;
+		hints.ai_socktype = 0;
+		hints.ai_protocol = 0;
+		hints.ai_addrlen = 0;
+		hints.ai_canonname = NULL;
+		hints.ai_addr = NULL;
+		hints.ai_next = NULL;
+
+		ret = getaddrinfo(address, NULL, &hints, &gai_result);
+		if (ret == 0 && gai_result)
+			memcpy(&port->raddr.addr, gai_result->ai_addr, gai_result->ai_addrlen);
+		else if (ret == EAI_NONAME)
+		{
+			struct addrinfo *gai_result2 = NULL;
+
+			port->remote_hostname = pstrdup(address);
+
+			ret = getaddrinfo(port->remote_hostname, NULL, NULL, &gai_result2);
+			if (ret == 0 && gai_result2)
+				memcpy(&port->raddr.addr, gai_result2->ai_addr, gai_result2->ai_addrlen);
+			else
+				ereport(ERROR,
+				(errmsg("getaddrinfo failed to look into hostname \"%s\": %s",
+						port->remote_hostname, gai_strerror(ret))));
+
+			if (gai_result2)
+				freeaddrinfo(gai_result2);
+		}
+		else
+			ereport(ERROR,
+					(errmsg("invalid IP address \"%s\": %s",
+							address, gai_strerror(ret))));
+		if (gai_result)
+			freeaddrinfo(gai_result);
+	}
+	else
+		port->raddr.addr.ss_family = AF_UNIX;
+
+	port->ssl_in_use = DatumGetBool(PG_GETARG_DATUM(3));
+
+	rsi->returnMode = SFRM_Materialize;
+
+	if (!load_hba())
+		ereport(ERROR,
+				(errmsg("failed to load pg_hba.conf file"),
+			   errhint("more details may be available in the server log.")));
+
+	/*
+	 * Create the tupledesc and tuplestore in the per_query context as
+	 * required for SFRM_Materialize.
+	 */
+	old_cxt = MemoryContextSwitchTo(rsi->econtext->ecxt_per_query_memory);
+
+	tupdesc = CreateTemplateTupleDesc(NUM_PG_HBA_LOOKUP_ATTS, false);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 1, "line_number",
+					   INT4OID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 2, "mode",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 3, "type",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 4, "keyword_database",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 5, "database",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 6, "keyword_user",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 7, "user_name",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 8, "keyword_address",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 9, "address",
+					   INETOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 10, "netmask",
+					   INETOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 11, "hostname",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 12, "method",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 13, "options",
+					   JSONBOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 14, "reason",
+					   TEXTOID, -1, 0);
+	BlessTupleDesc(tupdesc);
+
+	tuple_store =
+		tuplestore_begin_heap(rsi->allowedModes & SFRM_Materialize_Random,
+							  false, work_mem);
+
+	MemoryContextSwitchTo(old_cxt);
+
+	mycxt = (lookup_hba_line_context *) palloc(sizeof(lookup_hba_line_context));
+	mycxt->memcxt = AllocSetContextCreate(CurrentMemoryContext,
+										  "pg_hba_lookup tuple cxt",
+										  ALLOCSET_DEFAULT_MINSIZE,
+										  ALLOCSET_DEFAULT_INITSIZE,
+										  ALLOCSET_DEFAULT_MAXSIZE);
+	mycxt->tupdesc = tupdesc;
+	mycxt->tuple_store = tuple_store;
+
+	check_hba(port, lookup_hba_line_callback, mycxt);
+
+	MemoryContextDelete(mycxt->memcxt);
+	pfree(mycxt);
+
+	/* Clean up the memory allocated by load_hba() explicitly. */
+	discard_hba();
+
+	rsi->setDesc = tupdesc;
+	rsi->setResult = tuple_store;
+
+	PG_RETURN_NULL();
 }
diff --git a/src/backend/utils/adt/jsonb_util.c b/src/backend/utils/adt/jsonb_util.c
index e1ceea6..171e532 100644
--- a/src/backend/utils/adt/jsonb_util.c
+++ b/src/backend/utils/adt/jsonb_util.c
@@ -1802,3 +1802,49 @@ uniqueifyJsonbObject(JsonbValue *object)
 		object->val.object.nPairs = res + 1 - object->val.object.pairs;
 	}
 }
+
+void
+push_jsonb_string_key(JsonbParseState **pstate, char *string_key)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvString;
+	jb.val.string.len = strlen(string_key);
+	jb.val.string.val = pstrdup(string_key);
+	pushJsonbValue(pstate, WJB_KEY, &jb);
+}
+
+void
+push_jsonb_bool_value(JsonbParseState **pstate, bool bool_val)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvBool;
+	jb.val.boolean = bool_val;
+
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
+
+void
+push_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val)
+{
+	JsonbValue	jb;
+	char		outputstr[64];
+
+	snprintf(outputstr, 64, "%d", int32_val);
+	jb.type = jbvNumeric;
+	jb.val.numeric = DatumGetNumeric(DirectFunctionCall3(numeric_in, CStringGetDatum(outputstr), 0, -1));
+
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
+
+void
+push_jsonb_string_value(JsonbParseState **pstate, char *string_value)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvString;
+	jb.val.string.len = strlen(string_value);
+	jb.val.string.val = pstrdup(string_value);
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c
index b3f1bc4..a027fbe 100644
--- a/src/backend/utils/init/postinit.c
+++ b/src/backend/utils/init/postinit.c
@@ -192,18 +192,6 @@ PerformAuthentication(Port *port)
 	 * FIXME: [fork/exec] Ugh.  Is there a way around this overhead?
 	 */
 #ifdef EXEC_BACKEND
-	/*
-	 * load_hba() and load_ident() want to work within the PostmasterContext,
-	 * so create that if it doesn't exist (which it won't).  We'll delete it
-	 * again later, in PostgresMain.
-	 */
-	if (PostmasterContext == NULL)
-		PostmasterContext = AllocSetContextCreate(TopMemoryContext,
-												  "Postmaster",
-												  ALLOCSET_DEFAULT_MINSIZE,
-												  ALLOCSET_DEFAULT_INITSIZE,
-												  ALLOCSET_DEFAULT_MAXSIZE);
-
 	if (!load_hba())
 	{
 		/*
@@ -739,6 +727,14 @@ InitPostgres(const char *in_dbname, Oid dboid, const char *username,
 	}
 
 	/*
+	 * We don't need the HBA and ident data going forward, but we can't rely
+	 * on release of PostmasterContext to clean that up, so discard them
+	 * explicitly here.
+	 */
+	discard_hba();
+	discard_ident();
+
+	/*
 	 * If we're trying to shut down, only superusers can connect, and new
 	 * replication connections are not allowed.
 	 */
diff --git a/src/include/catalog/pg_proc.h b/src/include/catalog/pg_proc.h
index a595327..16f3f4a 100644
--- a/src/include/catalog/pg_proc.h
+++ b/src/include/catalog/pg_proc.h
@@ -3014,6 +3014,8 @@ DATA(insert OID = 2084 (  pg_show_all_settings	PGNSP PGUID 12 1 1000 0 0 f f f f
 DESCR("SHOW ALL as a function");
 DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
 DESCR("show config file settings");
+DATA(insert OID = 3997 (  pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f f t v u 4 0 2249 "25 25 25 16" "{25,25,25,16,23,25,25,1009,1009,1009,1009,25,869,869,25,25,3802,25}" "{i,i,i,i,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{database,user_name,address,ssl_inuse,line_number,mode,type,keyword_database,database,keyword_user,user_name,keyword_address,address,netmask,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+DESCR("view client authentication settings");
 DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
 DESCR("view system lock information");
 DATA(insert OID = 2561 (  pg_blocking_pids PGNSP PGUID 12 1 0 0 0 f f f f t f v s 1 0 1007 "23" _null_ _null_ _null_ _null_ _null_ pg_blocking_pids _null_ _null_ _null_ ));
diff --git a/src/include/libpq/hba.h b/src/include/libpq/hba.h
index 68a953a..291300b 100644
--- a/src/include/libpq/hba.h
+++ b/src/include/libpq/hba.h
@@ -98,6 +98,10 @@ typedef struct Port hbaPort;
 
 extern bool load_hba(void);
 extern bool load_ident(void);
+
+extern void discard_hba(void);
+extern void discard_ident(void);
+
 extern void hba_getauthmethod(hbaPort *port);
 extern int check_usermap(const char *usermap_name,
 			  const char *pg_role, const char *auth_user,
diff --git a/src/include/utils/builtins.h b/src/include/utils/builtins.h
index 206288d..96e0564 100644
--- a/src/include/utils/builtins.h
+++ b/src/include/utils/builtins.h
@@ -1159,6 +1159,9 @@ extern Datum pg_control_system(PG_FUNCTION_ARGS);
 extern Datum pg_control_init(PG_FUNCTION_ARGS);
 extern Datum pg_control_recovery(PG_FUNCTION_ARGS);
 
+/* hba.c */
+extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
+
 /* rls.c */
 extern Datum row_security_active(PG_FUNCTION_ARGS);
 extern Datum row_security_active_name(PG_FUNCTION_ARGS);
diff --git a/src/include/utils/jsonb.h b/src/include/utils/jsonb.h
index 5f49d8d..33e00d2 100644
--- a/src/include/utils/jsonb.h
+++ b/src/include/utils/jsonb.h
@@ -427,6 +427,12 @@ extern bool JsonbDeepContains(JsonbIterator **val,
 				  JsonbIterator **mContained);
 extern void JsonbHashScalarValue(const JsonbValue *scalarVal, uint32 *hash);
 
+/* jsonb_util.c support functions */
+void push_jsonb_string_key(JsonbParseState **pstate, char *string_key);
+void push_jsonb_bool_value(JsonbParseState **pstate, bool bool_val);
+void push_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val);
+void push_jsonb_string_value(JsonbParseState **pstate, char *string_value);
+
 /* jsonb.c support functions */
 extern char *JsonbToCString(StringInfo out, JsonbContainer *in,
 			   int estimated_len);

diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml
index ae93e69..b286681 100644
--- a/doc/src/sgml/func.sgml
+++ b/doc/src/sgml/func.sgml
@@ -17220,6 +17220,19 @@ SELECT collation for ('foo' COLLATE "de_DE");
        <entry><type>text</type></entry>
        <entry>set parameter and return new value</entry>
       </row>
+      <row>
+       <entry>
+        <indexterm>
+         <primary>pg_hba_lookup</primary>
+        </indexterm>
+        <literal><function>pg_hba_lookup(<parameter>database</> <type>text</>,
+                            <parameter>user_name</> <type>text</>
+                            [, <parameter>address</> <type>text</>]
+                            [, <parameter>ssl_inuse</> <type>text</>)</function></literal>
+       </entry>
+       <entry><type>record</type></entry>
+       <entry>scan <filename>pg_hba.conf</> and return examined entries up to a matching one</entry>
+      </row>
      </tbody>
     </tgroup>
    </table>
@@ -17277,6 +17290,32 @@ SELECT set_config('log_statement_stats', 'off', false);
 </programlisting>
    </para>
 
+   <para>
+    <function>pg_hba_lookup</function> returns a set of records containing the
+    line number, mode, type, database, user_name, address, netmask, hostname,
+    method, options and skip reason. For example, to debug problems with user
+    <literal>kommih</> trying to connect to a database <literal>postgres</>
+    from IPv6-address <literal>::1</>, one can issue a following query:
+<programlisting>
+postgres=# select * from pg_hba_lookup('postgres', 'kommih', '::1');
+ line_number |  mode   | type  | keyword_database | database | keyword_user | user_name | keyword_address |  address  |                 netmask                 | hostname | method | options |          reason          
+-------------+---------+-------+------------------+----------+--------------+-----------+-----------------+-----------+-----------------------------------------+----------+--------+---------+--------------------------
+          84 | skipped | local | {all}            |          | {all}        |           |                 |           |                                         |          | trust  | {}      | connection type mismatch
+          86 | skipped | host  | {all}            |          | {all}        |           |                 | 127.0.0.1 | 255.255.255.255                         |          | trust  | {}      | IP address mismatch
+          90 | matched | host  | {all}            |          | {all}        |           |                 | ::1       | ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff |          | trust  | {}      | 
+(3 rows)
+
+</programlisting>
+    This function actually loads the contents of <filename>pg_hba.conf</> file
+    into memory to perform matching, thus a database administrator can use it
+    to test the effects of changes made to the file in isolation prior to
+    actually applying the configuration cluster-wide with a signal to the
+    postmaster process.
+
+    Only superusers can access this function to look the
+    <filename>pg_hba.conf</> entries up.
+   </para>
+   
   </sect2>
 
   <sect2 id="functions-admin-signal">
diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql
index 9ae1ef4..eff567c 100644
--- a/src/backend/catalog/system_views.sql
+++ b/src/backend/catalog/system_views.sql
@@ -997,3 +997,13 @@ RETURNS text[]
 LANGUAGE INTERNAL
 STRICT IMMUTABLE
 AS 'parse_ident';
+
+CREATE OR REPLACE FUNCTION pg_hba_lookup(IN database text, IN user_name text,
+    IN address text DEFAULT NULL, IN ssl_inuse boolean DEFAULT false,
+    OUT line_number int, OUT mode text, OUT type text, OUT keyword_database text[],
+    OUT database text[], OUT keyword_user text[], OUT user_name text[],
+    OUT keyword_address text, OUT address inet, OUT netmask inet, OUT hostname text,
+    OUT method text, OUT options jsonb, OUT reason text)
+RETURNS SETOF RECORD
+LANGUAGE INTERNAL
+AS 'pg_hba_lookup';
diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index 28f9fb5..27e8c0c 100644
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -25,15 +25,22 @@
 #include <arpa/inet.h>
 #include <unistd.h>
 
+#include "access/htup_details.h"
+#include "catalog/objectaddress.h"
 #include "catalog/pg_collation.h"
+#include "catalog/pg_type.h"
+#include "funcapi.h"
 #include "libpq/ip.h"
 #include "libpq/libpq.h"
+#include "miscadmin.h"
 #include "postmaster/postmaster.h"
 #include "regex/regex.h"
 #include "replication/walsender.h"
 #include "storage/fd.h"
 #include "utils/acl.h"
+#include "utils/builtins.h"
 #include "utils/guc.h"
+#include "utils/jsonb.h"
 #include "utils/lsyscache.h"
 #include "utils/memutils.h"
 
@@ -52,6 +59,8 @@
 #define MAX_TOKEN	256
 #define MAX_LINE	8192
 
+#define NUM_PG_HBA_LOOKUP_ATTS	 14
+
 /* callback data for check_network_callback */
 typedef struct check_network_data
 {
@@ -75,6 +84,23 @@ typedef struct HbaToken
 } HbaToken;
 
 /*
+ * Optional callback function type for check_hba() function.
+ * Currently, valid callback function is passed to check_hba()
+ * by pg_hba_lookup system function to frame the hba tuple row
+ * based on inputs provided by the user.
+ */
+typedef void (*hba_line_callback) (void *context, HbaLine *hba_line,
+											   const char *reason);
+
+/* Context to use with lookup_hba_line_callback function. */
+typedef struct LookupHbaLineCxt
+{
+	MemoryContext memcxt;
+	TupleDesc	tupdesc;
+	Tuplestorestate *tuple_store;
+} LookupHbaLineCxt;
+
+/*
  * pre-parsed content of HBA config file: list of HbaLine structs.
  * parsed_hba_context is the memory context where it lives.
  */
@@ -99,6 +125,10 @@ static List *tokenize_inc_file(List *tokens, const char *outer_filename,
 				  const char *inc_filename);
 static bool parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
 				   int line_num);
+static Datum getauthmethod(UserAuth auth_method);
+static Jsonb *gethba_options(HbaLine *hba);
+static void lookup_hba_line_callback(void *context, HbaLine *hba, const char *reason);
+static bool token_is_a_database_keyword(HbaToken *tok);
 
 /*
  * isblank() exists in the ISO C99 spec, but it's not very portable yet,
@@ -541,6 +571,18 @@ check_db(const char *dbname, const char *role, Oid roleid, List *tokens)
 }
 
 static bool
+token_is_a_database_keyword(HbaToken *tok)
+{
+	if (token_is_keyword(tok, "replication")
+		|| token_is_keyword(tok, "all")
+		|| token_is_keyword(tok, "sameuser")
+		|| token_is_keyword(tok, "samegroup")
+		|| token_is_keyword(tok, "samerole"))
+		return true;
+	return false;
+}
+
+static bool
 ipv4eq(struct sockaddr_in * a, struct sockaddr_in * b)
 {
 	return (a->sin_addr.s_addr == b->sin_addr.s_addr);
@@ -1640,7 +1682,8 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num)
  *	request.
  */
 static void
-check_hba(hbaPort *port)
+check_hba(hbaPort *port, hba_line_callback callback,
+		  void *callback_context)
 {
 	Oid			roleid;
 	ListCell   *line;
@@ -1657,25 +1700,41 @@ check_hba(hbaPort *port)
 		if (hba->conntype == ctLocal)
 		{
 			if (!IS_AF_UNIX(port->raddr.addr.ss_family))
+			{
+				if (callback)
+					callback(callback_context, hba, _("connection type mismatch"));
 				continue;
+			}
 		}
 		else
 		{
 			if (IS_AF_UNIX(port->raddr.addr.ss_family))
+			{
+				if (callback)
+					callback(callback_context, hba, _("connection type mismatch"));
 				continue;
+			}
 
 			/* Check SSL state */
 			if (port->ssl_in_use)
 			{
 				/* Connection is SSL, match both "host" and "hostssl" */
 				if (hba->conntype == ctHostNoSSL)
+				{
+					if (callback)
+						callback(callback_context, hba, _("connection type mismatch"));
 					continue;
+				}
 			}
 			else
 			{
 				/* Connection is not SSL, match both "host" and "hostnossl" */
 				if (hba->conntype == ctHostSSL)
+				{
+					if (callback)
+						callback(callback_context, hba, _("connection type mismatch"));
 					continue;
+				}
 			}
 
 			/* Check IP address */
@@ -1686,14 +1745,22 @@ check_hba(hbaPort *port)
 					{
 						if (!check_hostname(port,
 											hba->hostname))
+						{
+							if (callback)
+								callback(callback_context, hba, _("hostname mismatch"));
 							continue;
+						}
 					}
 					else
 					{
 						if (!check_ip(&port->raddr,
 									  (struct sockaddr *) & hba->addr,
 									  (struct sockaddr *) & hba->mask))
+						{
+							if (callback)
+								callback(callback_context, hba, _("IP address mismatch"));
 							continue;
+						}
 					}
 					break;
 				case ipCmpAll:
@@ -1702,7 +1769,11 @@ check_hba(hbaPort *port)
 				case ipCmpSameNet:
 					if (!check_same_host_or_net(&port->raddr,
 												hba->ip_cmp_method))
+					{
+						if (callback)
+							callback(callback_context, hba, _("samehost/samenet mismatch"));
 						continue;
+					}
 					break;
 				default:
 					/* shouldn't get here, but deem it no-match if so */
@@ -1713,10 +1784,21 @@ check_hba(hbaPort *port)
 		/* Check database and role */
 		if (!check_db(port->database_name, port->user_name, roleid,
 					  hba->databases))
+		{
+			if (callback)
+				callback(callback_context, hba, _("database name mismatch"));
 			continue;
+		}
 
 		if (!check_role(port->user_name, roleid, hba->roles))
+		{
+			if (callback)
+				callback(callback_context, hba, _("user name mismatch"));
 			continue;
+		}
+
+		if (callback)
+			callback(callback_context, hba, NULL);
 
 		/* Found a record that matched! */
 		port->hba = hba;
@@ -1770,8 +1852,7 @@ load_hba(void)
 	FreeFile(file);
 
 	/* Now parse all the lines */
-	Assert(PostmasterContext);
-	hbacxt = AllocSetContextCreate(PostmasterContext,
+	hbacxt = AllocSetContextCreate(CurrentMemoryContext,
 								   "hba parser context",
 								   ALLOCSET_DEFAULT_MINSIZE,
 								   ALLOCSET_DEFAULT_MINSIZE,
@@ -1829,14 +1910,26 @@ load_hba(void)
 	}
 
 	/* Loaded new file successfully, replace the one we use */
-	if (parsed_hba_context != NULL)
-		MemoryContextDelete(parsed_hba_context);
+	discard_hba();
 	parsed_hba_context = hbacxt;
 	parsed_hba_lines = new_parsed_lines;
 
 	return true;
 }
 
+
+void
+discard_hba(void)
+{
+	if (parsed_hba_context != NULL)
+	{
+		MemoryContextDelete(parsed_hba_context);
+		parsed_hba_context = NULL;
+		parsed_hba_lines = NIL;
+	}
+}
+
+
 /*
  * Parse one tokenised line from the ident config file and store the result in
  * an IdentLine structure, or NULL if parsing fails.
@@ -2148,8 +2241,7 @@ load_ident(void)
 	FreeFile(file);
 
 	/* Now parse all the lines */
-	Assert(PostmasterContext);
-	ident_context = AllocSetContextCreate(PostmasterContext,
+	ident_context = AllocSetContextCreate(CurrentMemoryContext,
 										  "ident parser context",
 										  ALLOCSET_DEFAULT_MINSIZE,
 										  ALLOCSET_DEFAULT_MINSIZE,
@@ -2202,6 +2294,20 @@ load_ident(void)
 	}
 
 	/* Loaded new file successfully, replace the one we use */
+	discard_ident();
+	parsed_ident_context = ident_context;
+	parsed_ident_lines = new_parsed_lines;
+
+	return true;
+}
+
+
+void
+discard_ident(void)
+{
+	ListCell   *parsed_line_cell;
+	IdentLine  *newline;
+
 	if (parsed_ident_lines != NIL)
 	{
 		foreach(parsed_line_cell, parsed_ident_lines)
@@ -2210,18 +2316,17 @@ load_ident(void)
 			if (newline->ident_user[0] == '/')
 				pg_regfree(&newline->re);
 		}
+		parsed_ident_lines = NIL;
 	}
+
 	if (parsed_ident_context != NULL)
+	{
 		MemoryContextDelete(parsed_ident_context);
-
-	parsed_ident_context = ident_context;
-	parsed_ident_lines = new_parsed_lines;
-
-	return true;
+		parsed_ident_context = NULL;
+	}
 }
 
 
-
 /*
  *	Determine what authentication method should be used when accessing database
  *	"database" from frontend "raddr", user "user".  Return the method and
@@ -2233,5 +2338,567 @@ load_ident(void)
 void
 hba_getauthmethod(hbaPort *port)
 {
-	check_hba(port);
+	check_hba(port, NULL, NULL);
+}
+
+
+/*
+ * Returns the Text Datum representation of authentication method
+ */
+static Datum
+getauthmethod(UserAuth auth_method)
+{
+	Datum		result;
+
+	switch (auth_method)
+	{
+		case uaReject:
+			result = CStringGetTextDatum("reject");
+			break;
+		case uaTrust:
+			result = CStringGetTextDatum("trust");
+			break;
+		case uaIdent:
+			result = CStringGetTextDatum("ident");
+			break;
+		case uaPassword:
+			result = CStringGetTextDatum("password");
+			break;
+		case uaMD5:
+			result = CStringGetTextDatum("md5");
+			break;
+		case uaGSS:
+			result = CStringGetTextDatum("gss");
+			break;
+		case uaSSPI:
+			result = CStringGetTextDatum("sspi");
+			break;
+		case uaPAM:
+			result = CStringGetTextDatum("pam");
+			break;
+		case uaLDAP:
+			result = CStringGetTextDatum("ldap");
+			break;
+		case uaCert:
+			result = CStringGetTextDatum("cert");
+			break;
+		case uaRADIUS:
+			result = CStringGetTextDatum("radius");
+			break;
+		case uaPeer:
+			result = CStringGetTextDatum("peer");
+			break;
+		default:
+			elog(ERROR, "unexpected authentication method in parsed HBA entry");
+			break;
+	}
+
+	return result;
+}
+
+static Jsonb *
+gethba_options(HbaLine *hba)
+{
+	JsonbParseState *parseState = NULL;
+	JsonbValue *result;
+
+	result = pushJsonbValue(&parseState, WJB_BEGIN_OBJECT, NULL);
+
+	if (hba->auth_method == uaGSS || hba->auth_method == uaSSPI)
+	{
+		if (hba->include_realm)
+		{
+			push_jsonb_string_key(&parseState, "include_realm");
+			push_jsonb_bool_value(&parseState, true);
+		}
+
+		if (hba->krb_realm)
+		{
+			push_jsonb_string_key(&parseState, "krb_realm");
+			push_jsonb_string_value(&parseState, hba->krb_realm);
+		}
+	}
+
+	if (hba->usermap)
+	{
+		push_jsonb_string_key(&parseState, "map");
+		push_jsonb_string_value(&parseState, hba->usermap);
+	}
+
+	if (hba->clientcert)
+	{
+		push_jsonb_string_key(&parseState, "clientcert");
+		push_jsonb_bool_value(&parseState, true);
+	}
+
+	if (hba->pamservice)
+	{
+		push_jsonb_string_key(&parseState, "pamservice");
+		push_jsonb_string_value(&parseState, hba->pamservice);
+	}
+
+	if (hba->auth_method == uaLDAP)
+	{
+		if (hba->ldapserver)
+		{
+			push_jsonb_string_key(&parseState, "ldapserver");
+			push_jsonb_string_value(&parseState, hba->ldapserver);
+		}
+
+		if (hba->ldapport)
+		{
+			push_jsonb_string_key(&parseState, "ldapport");
+			push_jsonb_int32_value(&parseState, hba->ldapport);
+		}
+
+		if (hba->ldaptls)
+		{
+			push_jsonb_string_key(&parseState, "ldaptls");
+			push_jsonb_bool_value(&parseState, true);
+		}
+
+		if (hba->ldapprefix)
+		{
+			push_jsonb_string_key(&parseState, "ldapprefix");
+			push_jsonb_string_value(&parseState, hba->ldapprefix);
+		}
+
+		if (hba->ldapsuffix)
+		{
+			push_jsonb_string_key(&parseState, "ldapsuffix");
+			push_jsonb_string_value(&parseState, hba->ldapsuffix);
+		}
+
+		if (hba->ldapbasedn)
+		{
+			push_jsonb_string_key(&parseState, "ldapbasedn");
+			push_jsonb_string_value(&parseState, hba->ldapbasedn);
+		}
+
+		if (hba->ldapbinddn)
+		{
+			push_jsonb_string_key(&parseState, "ldapbinddn");
+			push_jsonb_string_value(&parseState, hba->ldapbinddn);
+		}
+
+		if (hba->ldapbindpasswd)
+		{
+			push_jsonb_string_key(&parseState, "ldapbindpasswd");
+			push_jsonb_string_value(&parseState, hba->ldapbindpasswd);
+		}
+
+		if (hba->ldapsearchattribute)
+		{
+			push_jsonb_string_key(&parseState, "ldapsearchattribute");
+			push_jsonb_string_value(&parseState, hba->ldapsearchattribute);
+		}
+
+		if (hba->ldapscope)
+		{
+			push_jsonb_string_key(&parseState, "ldapscope");
+			push_jsonb_int32_value(&parseState, hba->ldapscope);
+		}
+	}
+
+	if (hba->auth_method == uaRADIUS)
+	{
+		if (hba->radiusserver)
+		{
+			push_jsonb_string_key(&parseState, "radiusserver");
+			push_jsonb_string_value(&parseState, hba->radiusserver);
+		}
+
+		if (hba->radiussecret)
+		{
+			push_jsonb_string_key(&parseState, "radiussecret");
+			push_jsonb_string_value(&parseState, hba->radiussecret);
+		}
+
+		if (hba->radiusidentifier)
+		{
+			push_jsonb_string_key(&parseState, "radiusidentifier");
+			push_jsonb_string_value(&parseState, hba->radiusidentifier);
+		}
+
+		if (hba->radiusport)
+		{
+			push_jsonb_string_key(&parseState, "radiusport");
+			push_jsonb_int32_value(&parseState, hba->radiusport);
+		}
+	}
+
+	result = pushJsonbValue(&parseState, WJB_END_OBJECT, NULL);
+	return JsonbValueToJsonb(result);
+}
+
+
+static void
+lookup_hba_line_callback(void *context, HbaLine *hba, const char *reason)
+{
+	Datum		values[NUM_PG_HBA_LOOKUP_ATTS];
+	bool		nulls[NUM_PG_HBA_LOOKUP_ATTS];
+	ListCell   *dbcell;
+	char		buffer[NI_MAXHOST];
+	HeapTuple	tuple;
+	int			index;
+	MemoryContext old_cxt;
+	LookupHbaLineCxt *mycxt;
+
+	mycxt = (LookupHbaLineCxt *) context;
+
+	index = 0;
+	memset(values, 0, sizeof(values));
+	memset(nulls, 0, sizeof(nulls));
+
+	old_cxt = MemoryContextSwitchTo(mycxt->memcxt);
+
+	/* line_number */
+	values[index] = Int32GetDatum(hba->linenumber);
+
+	/* mode */
+	index++;
+	if (reason == NULL)
+		values[index] = CStringGetTextDatum(_("matched"));
+	else
+		values[index] = CStringGetTextDatum(_("skipped"));
+
+	/* type */
+	index++;
+	switch (hba->conntype)
+	{
+		case ctLocal:
+			values[index] = CStringGetTextDatum("local");
+			break;
+		case ctHost:
+			values[index] = CStringGetTextDatum("host");
+			break;
+		case ctHostSSL:
+			values[index] = CStringGetTextDatum("hostssl");
+			break;
+		case ctHostNoSSL:
+			values[index] = CStringGetTextDatum("hostnossl");
+			break;
+		default:
+			elog(ERROR, "unexpected connection type in parsed HBA entry");
+			break;
+	}
+
+	/* keyword_database and database */
+	index++;
+	if (list_length(hba->databases) != 0)
+	{
+		List	   *names = NULL;
+		List	   *keyword_names = NULL;
+		HbaToken   *tok;
+
+		foreach(dbcell, hba->databases)
+		{
+			tok = lfirst(dbcell);
+			if (token_is_a_database_keyword(tok))
+				keyword_names = lappend(keyword_names, tok->string);
+			else
+				names = lappend(names, tok->string);
+		}
+
+		/* keyword_database */
+		if (keyword_names != NULL)
+			values[index] = PointerGetDatum(strlist_to_textarray(keyword_names));
+		else
+			nulls[index] = true;
+
+		/* database */
+		index++;
+		if (names != NULL)
+			values[index] = PointerGetDatum(strlist_to_textarray(names));
+		else
+			nulls[index] = true;
+	}
+	else
+	{
+		nulls[index] = true;
+		index++;
+		nulls[index] = true;
+	}
+
+	/* keyword_user and user */
+	index++;
+	if (list_length(hba->roles) != 0)
+	{
+		List	   *roles = NULL;
+		List	   *keyword_roles = NULL;
+		HbaToken   *tok;
+
+		foreach(dbcell, hba->roles)
+		{
+			tok = lfirst(dbcell);
+			if (token_is_keyword(tok, "all"))
+				keyword_roles = lappend(keyword_roles, tok->string);
+			else
+				roles = lappend(roles, tok->string);
+		}
+
+		/* keyword_user */
+		if (keyword_roles != NULL)
+			values[index] = PointerGetDatum(strlist_to_textarray(keyword_roles));
+		else
+			nulls[index] = true;
+
+		/* user */
+		index++;
+		if (roles != NULL)
+			values[index] = PointerGetDatum(strlist_to_textarray(roles));
+		else
+			nulls[index] = true;
+	}
+	else
+	{
+		nulls[index] = true;
+		index++;
+		nulls[index] = true;
+	}
+
+	/* keyword_address */
+	index++;
+	switch (hba->ip_cmp_method)
+	{
+		case ipCmpAll:
+			values[index] = CStringGetTextDatum("all");
+			break;
+		case ipCmpSameHost:
+			values[index] = CStringGetTextDatum("samehost");
+			break;
+		case ipCmpSameNet:
+			values[index] = CStringGetTextDatum("samenet");
+			break;
+		default:
+			nulls[index] = true;
+			break;
+	}
+
+	/* address */
+	index++;
+	if (pg_getnameinfo_all(&hba->addr, sizeof(struct sockaddr_storage),
+						   buffer, sizeof(buffer),
+						   NULL, 0,
+						   NI_NUMERICHOST) == 0)
+	{
+		clean_ipv6_addr(hba->addr.ss_family, buffer);
+		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+	}
+	else
+		nulls[index] = true;
+
+	/* netmask */
+	index++;
+	if (pg_getnameinfo_all(&hba->mask, sizeof(struct sockaddr_storage),
+						   buffer, sizeof(buffer),
+						   NULL, 0,
+						   NI_NUMERICHOST) == 0)
+	{
+		clean_ipv6_addr(hba->mask.ss_family, buffer);
+		values[index] = DirectFunctionCall1(inet_in, CStringGetDatum(buffer));
+	}
+	else
+		nulls[index] = true;
+
+	/* hostname */
+	index++;
+	if (hba->hostname)
+		values[index] = CStringGetTextDatum(hba->hostname);
+	else
+		nulls[index] = true;
+
+	/* method */
+	index++;
+	values[index] = getauthmethod(hba->auth_method);
+
+	/* options */
+	index++;
+	values[index] = PointerGetDatum(gethba_options(hba));
+
+	/* reason */
+	index++;
+	if (reason)
+		values[index] = CStringGetTextDatum(reason);
+	else
+		nulls[index] = true;
+
+	tuple = heap_form_tuple(mycxt->tupdesc, values, nulls);
+	tuplestore_puttuple(mycxt->tuple_store, tuple);
+
+	MemoryContextSwitchTo(old_cxt);
+	return;
+}
+
+/*
+ * SQL-accessible SRF to return all the settings from the pg_hba.conf
+ * file.
+ */
+Datum
+pg_hba_lookup(PG_FUNCTION_ARGS)
+{
+	hbaPort    *port;
+	Tuplestorestate *tuple_store;
+	TupleDesc	tupdesc;
+	MemoryContext old_cxt;
+	LookupHbaLineCxt *mycxt;
+	ReturnSetInfo *rsi;
+
+	if (!superuser())
+		ereport(ERROR,
+				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+				 (errmsg("must be superuser to view pg_hba.conf settings"))));
+
+	/*
+	 * We must use the Materialize mode to be safe against HBA file reloads
+	 * while the cursor is open. It's also more efficient than having to look
+	 * up our current position in the parsed list every time.
+	 */
+	rsi = (ReturnSetInfo *) fcinfo->resultinfo;
+
+	if (!rsi || !IsA(rsi, ReturnSetInfo) ||
+		(rsi->allowedModes & SFRM_Materialize) == 0)
+		ereport(ERROR,
+				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+				 errmsg("set-valued function called in context that cannot accept a set")));
+
+	port = palloc0(sizeof(hbaPort));
+
+	if (PG_ARGISNULL(0))
+		ereport(ERROR,
+				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+				 (errmsg("database name is required to match pg_hba configuration entry"))));
+	else
+		port->database_name = TextDatumGetCString(PG_GETARG_DATUM(0));
+
+	if (PG_ARGISNULL(1))
+		ereport(ERROR,
+				(errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
+				 (errmsg("user name is required to match pg_hba configuration entry"))));
+	else
+		port->user_name = TextDatumGetCString(PG_GETARG_DATUM(1));
+
+
+	if (!PG_ARGISNULL(2))
+	{
+		char	   *address = NULL;
+		struct addrinfo *gai_result = NULL;
+		struct addrinfo hints;
+		int			ret;
+
+		address = TextDatumGetCString(PG_GETARG_DATUM(2));
+
+		/* Get the IP address either way */
+		hints.ai_flags = AI_NUMERICHOST;
+		hints.ai_family = AF_UNSPEC;
+		hints.ai_socktype = 0;
+		hints.ai_protocol = 0;
+		hints.ai_addrlen = 0;
+		hints.ai_canonname = NULL;
+		hints.ai_addr = NULL;
+		hints.ai_next = NULL;
+
+		ret = getaddrinfo(address, NULL, &hints, &gai_result);
+		if (ret == 0 && gai_result)
+			memcpy(&port->raddr.addr, gai_result->ai_addr, gai_result->ai_addrlen);
+		else if (ret == EAI_NONAME)
+		{
+			struct addrinfo *gai_result2 = NULL;
+
+			port->remote_hostname = pstrdup(address);
+
+			ret = getaddrinfo(port->remote_hostname, NULL, NULL, &gai_result2);
+			if (ret == 0 && gai_result2)
+				memcpy(&port->raddr.addr, gai_result2->ai_addr, gai_result2->ai_addrlen);
+			else
+				ereport(ERROR,
+				(errmsg("getaddrinfo failed to look into hostname \"%s\": %s",
+						port->remote_hostname, gai_strerror(ret))));
+
+			if (gai_result2)
+				freeaddrinfo(gai_result2);
+		}
+		else
+			ereport(ERROR,
+					(errmsg("invalid IP address \"%s\": %s",
+							address, gai_strerror(ret))));
+		if (gai_result)
+			freeaddrinfo(gai_result);
+	}
+	else
+		port->raddr.addr.ss_family = AF_UNIX;
+
+	port->ssl_in_use = DatumGetBool(PG_GETARG_DATUM(3));
+
+	rsi->returnMode = SFRM_Materialize;
+
+	if (!load_hba())
+		ereport(ERROR,
+				(errmsg("failed to load pg_hba.conf file"),
+			   errhint("more details may be available in the server log.")));
+
+	/*
+	 * Create the tupledesc and tuplestore in the per_query context as
+	 * required for SFRM_Materialize.
+	 */
+	old_cxt = MemoryContextSwitchTo(rsi->econtext->ecxt_per_query_memory);
+
+	tupdesc = CreateTemplateTupleDesc(NUM_PG_HBA_LOOKUP_ATTS, false);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 1, "line_number",
+					   INT4OID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 2, "mode",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 3, "type",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 4, "keyword_database",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 5, "database",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 6, "keyword_user",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 7, "user_name",
+					   TEXTARRAYOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 8, "keyword_address",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 9, "address",
+					   INETOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 10, "netmask",
+					   INETOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 11, "hostname",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 12, "method",
+					   TEXTOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 13, "options",
+					   JSONBOID, -1, 0);
+	TupleDescInitEntry(tupdesc, (AttrNumber) 14, "reason",
+					   TEXTOID, -1, 0);
+	BlessTupleDesc(tupdesc);
+
+	tuple_store =
+		tuplestore_begin_heap(rsi->allowedModes & SFRM_Materialize_Random,
+							  false, work_mem);
+
+	MemoryContextSwitchTo(old_cxt);
+
+	mycxt = (LookupHbaLineCxt *) palloc(sizeof(LookupHbaLineCxt));
+	mycxt->memcxt = AllocSetContextCreate(CurrentMemoryContext,
+										  "pg_hba_lookup tuple cxt",
+										  ALLOCSET_DEFAULT_MINSIZE,
+										  ALLOCSET_DEFAULT_INITSIZE,
+										  ALLOCSET_DEFAULT_MAXSIZE);
+	mycxt->tupdesc = tupdesc;
+	mycxt->tuple_store = tuple_store;
+
+	check_hba(port, lookup_hba_line_callback, mycxt);
+
+	MemoryContextDelete(mycxt->memcxt);
+	pfree(mycxt);
+
+	/* Clean up the memory allocated by load_hba() explicitly. */
+	discard_hba();
+
+	rsi->setDesc = tupdesc;
+	rsi->setResult = tuple_store;
+
+	PG_RETURN_NULL();
 }
diff --git a/src/backend/utils/adt/jsonb_util.c b/src/backend/utils/adt/jsonb_util.c
index e1ceea6..171e532 100644
--- a/src/backend/utils/adt/jsonb_util.c
+++ b/src/backend/utils/adt/jsonb_util.c
@@ -1802,3 +1802,49 @@ uniqueifyJsonbObject(JsonbValue *object)
 		object->val.object.nPairs = res + 1 - object->val.object.pairs;
 	}
 }
+
+void
+push_jsonb_string_key(JsonbParseState **pstate, char *string_key)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvString;
+	jb.val.string.len = strlen(string_key);
+	jb.val.string.val = pstrdup(string_key);
+	pushJsonbValue(pstate, WJB_KEY, &jb);
+}
+
+void
+push_jsonb_bool_value(JsonbParseState **pstate, bool bool_val)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvBool;
+	jb.val.boolean = bool_val;
+
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
+
+void
+push_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val)
+{
+	JsonbValue	jb;
+	char		outputstr[64];
+
+	snprintf(outputstr, 64, "%d", int32_val);
+	jb.type = jbvNumeric;
+	jb.val.numeric = DatumGetNumeric(DirectFunctionCall3(numeric_in, CStringGetDatum(outputstr), 0, -1));
+
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
+
+void
+push_jsonb_string_value(JsonbParseState **pstate, char *string_value)
+{
+	JsonbValue	jb;
+
+	jb.type = jbvString;
+	jb.val.string.len = strlen(string_value);
+	jb.val.string.val = pstrdup(string_value);
+	pushJsonbValue(pstate, WJB_VALUE, &jb);
+}
diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c
index b3f1bc4..a027fbe 100644
--- a/src/backend/utils/init/postinit.c
+++ b/src/backend/utils/init/postinit.c
@@ -192,18 +192,6 @@ PerformAuthentication(Port *port)
 	 * FIXME: [fork/exec] Ugh.  Is there a way around this overhead?
 	 */
 #ifdef EXEC_BACKEND
-	/*
-	 * load_hba() and load_ident() want to work within the PostmasterContext,
-	 * so create that if it doesn't exist (which it won't).  We'll delete it
-	 * again later, in PostgresMain.
-	 */
-	if (PostmasterContext == NULL)
-		PostmasterContext = AllocSetContextCreate(TopMemoryContext,
-												  "Postmaster",
-												  ALLOCSET_DEFAULT_MINSIZE,
-												  ALLOCSET_DEFAULT_INITSIZE,
-												  ALLOCSET_DEFAULT_MAXSIZE);
-
 	if (!load_hba())
 	{
 		/*
@@ -739,6 +727,14 @@ InitPostgres(const char *in_dbname, Oid dboid, const char *username,
 	}
 
 	/*
+	 * We don't need the HBA and ident data going forward, but we can't rely
+	 * on release of PostmasterContext to clean that up, so discard them
+	 * explicitly here.
+	 */
+	discard_hba();
+	discard_ident();
+
+	/*
 	 * If we're trying to shut down, only superusers can connect, and new
 	 * replication connections are not allowed.
 	 */
diff --git a/src/include/catalog/pg_proc.h b/src/include/catalog/pg_proc.h
index a595327..16f3f4a 100644
--- a/src/include/catalog/pg_proc.h
+++ b/src/include/catalog/pg_proc.h
@@ -3014,6 +3014,8 @@ DATA(insert OID = 2084 (  pg_show_all_settings	PGNSP PGUID 12 1 1000 0 0 f f f f
 DESCR("SHOW ALL as a function");
 DATA(insert OID = 3329 (  pg_show_all_file_settings PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,23,23,25,25,16,25}" "{o,o,o,o,o,o,o}" "{sourcefile,sourceline,seqno,name,setting,applied,error}" _null_ _null_ show_all_file_settings _null_ _null_ _null_ ));
 DESCR("show config file settings");
+DATA(insert OID = 3997 (  pg_hba_lookup PGNSP PGUID 12 1 1000 0 0 f f f f f t v u 4 0 2249 "25 25 25 16" "{25,25,25,16,23,25,25,1009,1009,1009,1009,25,869,869,25,25,3802,25}" "{i,i,i,i,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{database,user_name,address,ssl_inuse,line_number,mode,type,keyword_database,database,keyword_user,user_name,keyword_address,address,netmask,hostname,method,options,reason}" _null_ _null_ pg_hba_lookup _null_ _null_ _null_));
+DESCR("view client authentication settings");
 DATA(insert OID = 1371 (  pg_lock_status   PGNSP PGUID 12 1 1000 0 0 f f f f t t v s 0 0 2249 "" "{25,26,26,23,21,25,28,26,26,21,25,23,25,16,16}" "{o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}" "{locktype,database,relation,page,tuple,virtualxid,transactionid,classid,objid,objsubid,virtualtransaction,pid,mode,granted,fastpath}" _null_ _null_ pg_lock_status _null_ _null_ _null_ ));
 DESCR("view system lock information");
 DATA(insert OID = 2561 (  pg_blocking_pids PGNSP PGUID 12 1 0 0 0 f f f f t f v s 1 0 1007 "23" _null_ _null_ _null_ _null_ _null_ pg_blocking_pids _null_ _null_ _null_ ));
diff --git a/src/include/libpq/hba.h b/src/include/libpq/hba.h
index 68a953a..291300b 100644
--- a/src/include/libpq/hba.h
+++ b/src/include/libpq/hba.h
@@ -98,6 +98,10 @@ typedef struct Port hbaPort;
 
 extern bool load_hba(void);
 extern bool load_ident(void);
+
+extern void discard_hba(void);
+extern void discard_ident(void);
+
 extern void hba_getauthmethod(hbaPort *port);
 extern int check_usermap(const char *usermap_name,
 			  const char *pg_role, const char *auth_user,
diff --git a/src/include/utils/builtins.h b/src/include/utils/builtins.h
index 206288d..96e0564 100644
--- a/src/include/utils/builtins.h
+++ b/src/include/utils/builtins.h
@@ -1159,6 +1159,9 @@ extern Datum pg_control_system(PG_FUNCTION_ARGS);
 extern Datum pg_control_init(PG_FUNCTION_ARGS);
 extern Datum pg_control_recovery(PG_FUNCTION_ARGS);
 
+/* hba.c */
+extern Datum pg_hba_lookup(PG_FUNCTION_ARGS);
+
 /* rls.c */
 extern Datum row_security_active(PG_FUNCTION_ARGS);
 extern Datum row_security_active_name(PG_FUNCTION_ARGS);
diff --git a/src/include/utils/jsonb.h b/src/include/utils/jsonb.h
index 5f49d8d..33e00d2 100644
--- a/src/include/utils/jsonb.h
+++ b/src/include/utils/jsonb.h
@@ -427,6 +427,12 @@ extern bool JsonbDeepContains(JsonbIterator **val,
 				  JsonbIterator **mContained);
 extern void JsonbHashScalarValue(const JsonbValue *scalarVal, uint32 *hash);
 
+/* jsonb_util.c support functions */
+void push_jsonb_string_key(JsonbParseState **pstate, char *string_key);
+void push_jsonb_bool_value(JsonbParseState **pstate, bool bool_val);
+void push_jsonb_int32_value(JsonbParseState **pstate, int32 int32_val);
+void push_jsonb_string_value(JsonbParseState **pstate, char *string_value);
+
 /* jsonb.c support functions */
 extern char *JsonbToCString(StringInfo out, JsonbContainer *in,
 			   int estimated_len);
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index b850db0..fc32551 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -1073,6 +1073,7 @@ LogicalOutputPluginWriterWrite
 LogicalRewriteMappingData
 LogicalTape
 LogicalTapeSet
+LookupHbaLineCxt
 MAGIC
 MBuf
 MEMORY_BASIC_INFORMATION