Message-ID: <09c4b7dc-901d-135e-087b-808c489e0d81@jakobs.com>
Date: Fri, 9 Feb 2024 20:05:23 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.12.0
Content-Language: de-DE
To: pgsql-admin@lists.postgresql.org
References: 
 <GV1P189MB2132400900DA53D139B09DAFA24B2@GV1P189MB2132.EURP189.PROD.OUTLOOK.COM>
From: Holger Jakobs <holger@jakobs.com>
Subject: Re: Use AD-account as login into Postgres.
In-Reply-To: 
 <GV1P189MB2132400900DA53D139B09DAFA24B2@GV1P189MB2132.EURP189.PROD.OUTLOOK.COM>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="------------2506XsbTGMiLc5qmqXmaUKBt"
Archived-At: 
 <https://www.postgresql.org/message-id/09c4b7dc-901d-135e-087b-808c489e0d81%40jakobs.com>
Precedence: bulk

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------2506XsbTGMiLc5qmqXmaUKBt
Content-Type: multipart/mixed; boundary="------------QsAyNudvGFi1Z0zRP0sMcIwC";
 protected-headers="v1"
From: Holger Jakobs <holger@jakobs.com>
To: pgsql-admin@lists.postgresql.org
Message-ID: <09c4b7dc-901d-135e-087b-808c489e0d81@jakobs.com>
Subject: Re: Use AD-account as login into Postgres.
References: <GV1P189MB2132400900DA53D139B09DAFA24B2@GV1P189MB2132.EURP189.PROD.OUTLOOK.COM>
In-Reply-To: <GV1P189MB2132400900DA53D139B09DAFA24B2@GV1P189MB2132.EURP189.PROD.OUTLOOK.COM>

--------------QsAyNudvGFi1Z0zRP0sMcIwC
Content-Type: multipart/alternative;
 boundary="------------S34W3OiaRtt7oi1bdH1C3030"

--------------S34W3OiaRtt7oi1bdH1C3030
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

QW0gMDkuMDIuMjQgdW0gMTk6MzEgc2NocmllYiBQw6RyIE1hdHRzc29uOg0KPiBIaSENCj4g
SXMgaXQgb25seSB0byBjb25maWcgaW4gaGJhLmNvbmYgdGhlIGNvbm5lY3Rpb24gaW5mbywg
wqB0byB1c2UgDQo+IEFELWFjY291bnRzIHRvIGxvZ2luIGluIHBvc3RncmVzLg0KPiBUaGlz
IGlzIGEgd2luZG93cy9wb3N0cmVzIGludGFsbGF0aW9uIPCfpKbigI3imYLvuI/inIzvuI8N
Cj4NCj4gTXZoIFDDpHINCj4gKzQ2NzA2MDY5NjQ1DQoNCkhpLA0KDQpTaG9ydCBhbnN3ZXI6
IE5vIQ0KDQpTU1BJIHVzaW5nIEFEIGFjY291bnRzIGZvciBhdXRoZW50aWNhdGlvbiB3b3Jr
cyBvbmx5IGluIGEgY29tcGxldGUgDQpXaW5kb3dzIGVudmlyb25tZW50LiBUaGUgY2xpZW50
IGFuZCB0aGUgc2VydmVyIG1hY2hpbmUgaGF2ZSB0byBiZSBtZW1iZXIgDQpvZiB0aGUgc2Ft
ZSBBRCBlbnZpcm9ubWVudCwgd2hpY2ggaXNuJ3QgcG9zc2libGUgZm9yIG5vbi1XaW5kb3dz
IA0KbWFjaGluZXMuIE90aGVyd2lzZSwgdGhlcmUgaXMgbm8gdHJ1c3QgYmV0d2VlbiB0aGUg
bWFjaGluZXMuDQoNCkFuIGF1dG9tYXRpYyBjcmVhdGlvbiBvZiBQb3N0Z3JlU1FMIHJvbGVz
IGZyb20gQUQgYWNjb3VudHMgaGFzIHRvIGJlIA0KZG9uZSBvdXRzaWRlIFBvc3RncmVTUUws
IGkuIGUuIGJ5IGEgc2NyaXB0IHJ1bm5pbmcgcmVndWxhcmx5Lg0KDQpBIGNvdXBsZSBvZiB5
ZWFycyBhZ28sIEkgd3JvdGUgc3VjaCBhIHNjcmlwdCBmb3IgYSBjdXN0b21lci4NCg0KUmVn
YXJkcywNCg0KSG9sZ2VyDQoNCi0tIA0KSG9sZ2VyIEpha29icywgQmVyZ2lzY2ggR2xhZGJh
Y2gsIFRlbC4gKzQ5LTE3OC05NzU5MDEyDQoNCg==
--------------S34W3OiaRtt7oi1bdH1C3030
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<html>
  <head>
    <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF=
-8">
  </head>
  <body>
    <div class=3D"moz-cite-prefix">Am 09.02.24 um 19:31 schrieb P=C3=A4r
      Mattsson:<br>
    </div>
    <blockquote type=3D"cite"
cite=3D"mid:GV1P189MB2132400900DA53D139B09DAFA24B2@GV1P189MB2132.EURP189.=
PROD.OUTLOOK.COM">
      <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DU=
TF-8">
      <div dir=3D"ltr">
        <div dir=3D"ltr">Hi!</div>
        <div dir=3D"ltr">Is it only to config in hba.conf the connection
          info, =C2=A0to use AD-accounts to login in postgres.</div>
        <div dir=3D"ltr">This is a windows/postres intallation =F0=9F=A4=A6=
=E2=80=8D=E2=99=82=EF=B8=8F=E2=9C=8C=EF=B8=8F</div>
        <div id=3D"ms-outlook-mobile-signature">
          <div><br>
          </div>
          <div>Mvh P=C3=A4r</div>
          <div dir=3D"ltr">+46706069645</div>
        </div>
      </div>
    </blockquote>
    <p>Hi,</p>
    <p>Short answer: No!</p>
    <p>SSPI using AD accounts for authentication works only in a
      complete Windows environment. The client and the server machine
      have to be member of the same AD environment, which isn't possible
      for non-Windows machines. Otherwise, there is no trust between the
      machines.<br>
    </p>
    <p>An automatic creation of PostgreSQL roles from AD accounts has to
      be done outside PostgreSQL, i. e. by a script running regularly.</p=
>
    <p>A couple of years ago, I wrote such a script for a customer.</p>
    <p>Regards,</p>
    <p>Holger<br>
    </p>
    <pre class=3D"moz-signature" cols=3D"72">--=20
Holger Jakobs, Bergisch Gladbach, Tel. +49-178-9759012</pre>
  </body>
</html>

--------------S34W3OiaRtt7oi1bdH1C3030--

--------------QsAyNudvGFi1Z0zRP0sMcIwC--

--------------2506XsbTGMiLc5qmqXmaUKBt
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

wmMEABEIACMWIQScuJCxWJK1p5BOebGKV5yTsxlhugUCZcZ3cwUDAAAAAAAKCRCKV5yTsxlhujz0
AJ49ASj8fwrxmPNebku3dU1eKRyp/ACgiBUVZ3RCtkdOj2ofYmpN241bfkw=
=D8gB
-----END PGP SIGNATURE-----

--------------2506XsbTGMiLc5qmqXmaUKBt--