Date: Mon, 25 Mar 2013 09:25:57 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Tim Watts <tim.j.watts@kcl.ac.uk>
Cc: "pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
Subject: Re: Postgresql 8.4 GSSAPI auth with fallback to password
 prompting?
Message-ID: <20130325132557.GM4361@tamriel.snowman.net>
References: <514AFB73.6050300@kcl.ac.uk>
	<5c910ac4f9fa4dc78f1ba6747182b671@DBXPRD0310HT003.eurprd03.prod.outlook.com>
	<51502949.6000903@kcl.ac.uk>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="V1NlN/V7gk8OJNgm"
Content-Disposition: inline
In-Reply-To: <51502949.6000903@kcl.ac.uk>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org


--V1NlN/V7gk8OJNgm
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Tim,

* Tim Watts (tim.j.watts@kcl.ac.uk) wrote:
> I would have to respectfully take another point of view: that that
> particular judgement is probably better placed with the sysadmin
> rather than a blanket decision by the devs.

It's not a blanket decision by any means- the current situation is that
such an option doesn't exist.  It's not "it exists, but we disabled it
because we felt like it."

Were someone to write the code to support such an option, it's entirely
possible it'd get committed (though likely with strong caveats about its
use in the documentation).

> Reason: Whilst the argument is solid in an ideal world (all clients
> are part of the kerberos realm), in reality it means that I cannot
> gain partial security improvements and I have to leave it running
> with PAM auth which ensures that passwords are chucked around 100%
> of the time.

The pg_hba.conf allows you to migrate users or sets of users at a time.
Having a fall-back mechanism if Kerberos doesn't work is a different
thing.  My experience has been that all clients (or at least, all in a
given IP range or for a set of users) *are* part of the Kerberos realm
because they're coming from Active Directory or another entrenched
Kerberos installation.  That's specifically because that's how
Kerberos is intended to work and how it provides a strong
authentication mechanism.

> But it would be nice to be able to use kerberos tickets *where
> available* and fallback to password-interactive login where not.=20

And I continue to contend that this is a very bad idea.

	Thanks,

		Stephen

--V1NlN/V7gk8OJNgm
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlFQUGUACgkQrzgMPqB3kigAHACeKcRDL9s9LmLRabNdsPHJ6M4Z
EVcAn13hTIitu/3E70l8tHOQ/PfNCAqH
=G1K7
-----END PGP SIGNATURE-----

--V1NlN/V7gk8OJNgm--