Posted as a blog comment but I'd be interested in people's thoughts: LDAP can be painful to work with, even when using such "industry standards" like Active Di

Posted as a blog comment but I'd be interested in people's thoughts: LDAP can be painful to work with, even when using such "industry standards" like Active Directory I think a specialised server (or even Postgres extension) could be useful but couldn't you set up the following? * Create a stored proc or similar that does this: SELECT COUNT(PasswordHash) WHERE Username = @Username AND PasswordHash = @PasswordHash * Create a user account on the database that only has EXEC permissions, not SELECT or anything else * Restrict the user account to only be able to log in from the app servers (or whatever) * Restrict the DB admin to only login via a jump box / VPN.