pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedGSSAPI auth issue with windows 7 client, postgresql 9.2.3 linux server
4+ messages / 2 participants
[nested] [flat]
* GSSAPI auth issue with windows 7 client, postgresql 9.2.3 linux server
@ 2014-01-14 12:32 jaime soler <jaime.soler@gmail.com>
0 siblings, 1 reply; 4+ messages in thread
From: jaime soler @ 2014-01-14 12:32 UTC (permalink / raw)
To: pgsql-admin
Hi list,
I am able to successfully authenticate a Windows server AD user with
PostgreSQL 9.2.3 version from linux clients but It doesn't work with
Windows client.
First I logon windows 7, using a Active Directory's user, then I tried
to login to postgresql 9.2.3 server with psql:
psql -h hostname -p 5444
psql: SSPI continuation error: The encryption type requested is not
supported by the KDC. (80090342)
postgresql.log :
-1 log: connection received: host = 172.XXX.XXX.XXX port = 61877
-1FATAL: GSSAPI authentication failed for 'userXX' user
userXX exists in our postgresql server and pg_hba.conf applied to
172.XXX.XXX.XXX subnet is:
host all all 172.0.0.0/8 gss
Our postgresql.conf use keytab:
krb_server_keyfile = 'postgres.keytab'
And I have generated keytab with this ktpass command:
ktpass -out postgres.keytab -princ
postgres/hostname@domain -mapUser postgres -pass
XXX -crypto DES-CBC-MD5
The postgres user, exists in the Active Directory and it has a spn
defined:
C:\Users\Administrator>setspn -S postgres/hostname
domain\postgres
Checking domain DC=domain
Registering ServicePrincipalNames for CN=postgres,CN=Users,DC=domain
postgres/hostname
Updated object
If I login from a linux client to linux server, there is no problem:
[root@hostnane datos]# su - userXX
[userXX@hostname ~]$ klist
Ticket cache: FILE:/tmp/krb5cc_503
Default principal: userXX@domain
Valid starting Expires Service principal
12/11/13 08:42:04 12/11/13 18:42:09 krbtgt/domain@domain
renew until 12/18/13 08:42:04
12/11/13 08:42:43 12/11/13 18:42:09 postgres/hostname@domain
renew until 12/18/13 08:42:04
[userXX@u2vbddpg ~]$ psql -h 172.XX.XX.XX
psql (9.2.1.3)
Type "help" for help.
edb=>
Thanks
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: GSSAPI auth issue with windows 7 client, postgresql 9.2.3 linux server
@ 2014-01-14 13:19 Stephen Frost <sfrost@snowman.net>
parent: jaime soler <jaime.soler@gmail.com>
0 siblings, 1 reply; 4+ messages in thread
From: Stephen Frost @ 2014-01-14 13:19 UTC (permalink / raw)
To: jaime soler <jaime.soler@gmail.com>; +Cc: pgsql-admin
* jaime soler (jaime.soler@gmail.com) wrote:
> psql: SSPI continuation error: The encryption type requested is not
> supported by the KDC. (80090342)
[...]
> ktpass -out postgres.keytab -princ
> postgres/hostname@domain -mapUser postgres -pass
> XXX -crypto DES-CBC-MD5
Not 100% sure this is it, but it looks like you're using an ancient
encryption algo which is no longer supported by MIT Kerberos (very
intentionally...). Why aren't you using AES256 instead?
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 835B) download
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: GSSAPI auth issue with windows 7 client, postgresql 9.2.3 linux server
@ 2014-01-14 14:18 jaime soler <jaime.soler@gmail.com>
parent: Stephen Frost <sfrost@snowman.net>
0 siblings, 1 reply; 4+ messages in thread
From: jaime soler @ 2014-01-14 14:18 UTC (permalink / raw)
To: Stephen Frost <sfrost@snowman.net>; +Cc: pgsql-admin
El mar, 14-01-2014 a las 08:19 -0500, Stephen Frost escribió:
> * jaime soler (jaime.soler@gmail.com) wrote:
> > psql: SSPI continuation error: The encryption type requested is not
> > supported by the KDC. (80090342)
>
> [...]
>
> > ktpass -out postgres.keytab -princ
> > postgres/hostname@domain -mapUser postgres -pass
> > XXX -crypto DES-CBC-MD5
>
> Not 100% sure this is it, but it looks like you're using an ancient
> encryption algo which is no longer supported by MIT Kerberos (very
> intentionally...). Why aren't you using AES256 instead?
So, should I use ALL as argument to -crypto option as it follows ?
ktpass -out postgres.keytab -princ
postgres/hostname@domain -mapUser postgres -pass
XXX -crypto ALL
Thanks,
Jaime
>
> Thanks,
>
> Stephen
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: GSSAPI auth issue with windows 7 client, postgresql 9.2.3 linux server
@ 2014-01-14 14:20 Stephen Frost <sfrost@snowman.net>
parent: jaime soler <jaime.soler@gmail.com>
0 siblings, 0 replies; 4+ messages in thread
From: Stephen Frost @ 2014-01-14 14:20 UTC (permalink / raw)
To: jaime soler <jaime.soler@gmail.com>; +Cc: pgsql-admin
* jaime soler (jaime.soler@gmail.com) wrote:
> So, should I use ALL as argument to -crypto option as it follows ?
>
> ktpass -out postgres.keytab -princ
> postgres/hostname@domain -mapUser postgres -pass
> XXX -crypto ALL
You could, or you could use AES256-SHA1 ...
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 835B) download
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2014-01-14 14:20 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2014-01-14 12:32 GSSAPI auth issue with windows 7 client, postgresql 9.2.3 linux server jaime soler <jaime.soler@gmail.com>
2014-01-14 13:19 ` Stephen Frost <sfrost@snowman.net>
2014-01-14 14:18 ` jaime soler <jaime.soler@gmail.com>
2014-01-14 14:20 ` Stephen Frost <sfrost@snowman.net>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox