Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YUFEb-0006fo-C7 for pgsql-admin@arkaria.postgresql.org; Sat, 07 Mar 2015 13:57:41 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.80) (envelope-from ) id 1YUFEa-00034e-OO for pgsql-admin@arkaria.postgresql.org; Sat, 07 Mar 2015 13:57:40 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1YUFEZ-00034Y-Vv for pgsql-admin@postgresql.org; Sat, 07 Mar 2015 13:57:40 +0000 Received: from tamriel.snowman.net ([2001:4830:167b::11]) by magus.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YUFER-0005W7-SO for pgsql-admin@postgresql.org; Sat, 07 Mar 2015 13:57:38 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 6D3425F7A1; Sat, 7 Mar 2015 08:57:29 -0500 (EST) Date: Sat, 7 Mar 2015 08:57:29 -0500 From: Stephen Frost To: John Scalia Cc: "pgsql-admin@postgresql.org" Subject: Re: authenticating using Active Directory? Message-ID: <20150307135729.GC29780@tamriel.snowman.net> References: <54FA69F0.304@gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="rONOH+FmdpCmW4qS" Content-Disposition: inline In-Reply-To: <54FA69F0.304@gmail.com> X-Editor: Vim http://www.vim.org/ X-Info: http://www.snowman.net X-Operating-System: Linux/3.13.0-45-generic (x86_64) X-Uptime: 08:53:50 up 44 days, 13:42, 15 users, load average: 0.01, 0.11, 0.18 User-Agent: Mutt/1.5.21 (2010-09-15) X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-admin Precedence: bulk Sender: pgsql-admin-owner@postgresql.org --rONOH+FmdpCmW4qS Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Jay,, * John Scalia (jayknowsunix@gmail.com) wrote: > A new federal related project has asked me if PostgreSQL can authenticate a user using Active Directory or LDAP. I've never used either of these and therefore have no real idea. > Hence, my question. Is there a way to use either of these technologies to authenticate a user? The short answer is yes. Active Directory uses Kerberos for authentication, which PostgreSQL supports through the GSS authentication mechanism. LDAP authentication is also supported but is strongly discouraged in an Active Directory environment (by Microsoft) as Kerberos should be used instead since it's a much more secure solution. LDAP-based authentication requires sending the password to PG as cleartext. Thanks! Stephen --rONOH+FmdpCmW4qS Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJU+wPIAAoJEO1sijiDR2RVqmYQALqINnEZmnRYwBk4WMZwfJmU FSRv67PBJOv4NjU04XDV8uECiMkJXfkLZux2Vjttz/IlIcZjLTuUpqr/pVopcHBW qumxtzBeKamFFGwW3+9eWLHVrixMypaEyjOxbtEXVs/PtxQHqDFUAYQGOBM3KOVS dMUiRp4vfZ/+q3k2+IyFuupOAZQXzZ+ZGVh5Az1t0j1S4e//UyYuOonrg2VA0/nQ bAea3gjA5RHp5ZibhJ79p3Zl1hdiaR9Aku9JAUEo1u8/NjX/9kir5IJaHtQSUTkP V7HRiJDg7wLC9MWlasH74/LhHLJdizwgMhUnzL5/0gdQlR9vaBJ/UXX2qNrdUPnH G8DUCT/SM8+G5G75mb1mhXrL6JevXeU0lPI/v93NIbSV7ghm+W/ZQVuiKRKDbgwr hfDXY09mOrhB2Kid1jChFh8H+Wr1j+1IaWPDnlwkXob6mF7JL2cMO6gPeSbuqi0I ojOXPhUv6qVvS6WVLdsBcpvbfAcRI9dwH0/moIVPtyQ455aDgoxXH1QomdPY8QBM mwCNqF/MqXprn3BBxa/ZEde3AUH8T4H91rvzWUlo5kBbchuNyF4d18t+nynRic6K MxcIhPij9Z26ZFadTrn148w7CPXlMYoA9vGkLZLB3m8/ht6f+5e7jSo5mTQTKQPk ff8GyjjVHKznkuhL4rB/ =uDGl -----END PGP SIGNATURE----- --rONOH+FmdpCmW4qS--