Background process forked by postmaster perform authentication
Previously I thought the postmaster who perform the authentication of client. But the postmaster simply a fork a background process which actually perform the authentication of the client.
When a request message is received, we now fork() immediately. The child process performs authentication of the request, and then becomes a backend if successful. This allows the auth code to be written in a simple single-threaded style (as opposed to the crufty “poor man’s multitasking” code that used to be needed). More importantly, it ensures that blockages in non-multi threaded libraries like SSL or PAM cannot cause denial of service to other clients.
Reference :
https://github.com/postgres/postgres/blob/master/src/backend/postmaster/postmaster.c
Viswamitra's blog 