Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.72) (envelope-from ) id 1UJpwp-00071V-Rd for pgsql-admin@arkaria.postgresql.org; Sun, 24 Mar 2013 18:47:15 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.72) (envelope-from ) id 1UJpwp-0003cT-4M for pgsql-admin@arkaria.postgresql.org; Sun, 24 Mar 2013 18:47:15 +0000 Received: from makus.postgresql.org ([2001:4800:7903:4::125]) by malur.postgresql.org with esmtp (Exim 4.72) (envelope-from ) id 1UJpwn-0003cN-Ug for pgsql-admin@postgresql.org; Sun, 24 Mar 2013 18:47:14 +0000 Received: from cl-262.qas-01.us.sixxs.net ([2001:4830:1600:105::2] helo=tamriel.snowman.net) by makus.postgresql.org with esmtp (Exim 4.72) (envelope-from ) id 1UJpwl-0003FW-H7 for pgsql-admin@postgresql.org; Sun, 24 Mar 2013 18:47:13 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 1885322233; Sun, 24 Mar 2013 14:47:10 -0400 (EDT) Date: Sun, 24 Mar 2013 14:47:10 -0400 From: Stephen Frost To: Tim Watts Cc: pgsql-admin@postgresql.org Subject: Re: Postgresql 8.4 GSSAPI auth with fallback to password prompting? Message-ID: <20130324184710.GI4361@tamriel.snowman.net> References: <514AFB73.6050300@kcl.ac.uk> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="8Ll2WeG2L2s3+nMg" Content-Disposition: inline In-Reply-To: <514AFB73.6050300@kcl.ac.uk> X-Editor: Vim http://www.vim.org/ X-Info: http://www.snowman.net X-Operating-System: Linux/3.2.0-4-amd64 (x86_64) X-Uptime: 14:43:05 up 150 days, 17:06, 4 users, load average: 0.16, 0.21, 0.18 User-Agent: Mutt/1.5.21 (2010-09-15) X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-admin Precedence: bulk Sender: pgsql-admin-owner@postgresql.org --8Ll2WeG2L2s3+nMg Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Tim, * Tim Watts (tim.j.watts@kcl.ac.uk) wrote: > Is it possible to specify GSSAPI auth (with MIT kerberos as the > backend) but get Postgresql to fallback to prompting for a password > if a kerberos ticket cannot be supplied by the client - eg because > the client cannot do GSSAPI or because the client is not part of the > kerberos realm? You're right- it's a 'no'. It would also really degrade the security which you get with Kerberos as you'd undoubtably end up with clients storing those passwords and using them routinely instead of using Kerberos. Thanks, Stephen --8Ll2WeG2L2s3+nMg Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlFPSi4ACgkQrzgMPqB3kiii2wCeM1P68pu/kesAtQo/lhdAx4pz m38AnjlTKoaPY7k/gZJQrY/uP3bFLFHv =2HYS -----END PGP SIGNATURE----- --8Ll2WeG2L2s3+nMg--