Date: Sat, 7 Mar 2015 09:40:28 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Jeffrey Shaw <shawjef3@gmail.com>
Cc: John Scalia <jayknowsunix@gmail.com>,
 "pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
Subject: Re: authenticating using Active Directory?
Message-ID: <20150307144028.GE29780@tamriel.snowman.net>
References: <54FA69F0.304@gmail.com>
 <20150307135729.GC29780@tamriel.snowman.net>
 <CAJYh909Xd0dAjG6Rww_5GPH2RdtQWuBJTmtFLEtvxRHVRP3PLQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="XfQyFtxChl4bBa/T"
Content-Disposition: inline
In-Reply-To: 
 <CAJYh909Xd0dAjG6Rww_5GPH2RdtQWuBJTmtFLEtvxRHVRP3PLQ@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org


--XfQyFtxChl4bBa/T
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Jeffrey Shaw (shawjef3@gmail.com) wrote:
> I spent a significant amount of time trying to make Windows users able to
> authenticate to PostgreSQL using Kerberos. I found that it was only
> possible if the server was running on Windows. If I ran the server on
> Linux, only Linux clients were able to authenticate. I asked EnterpriseDB
> for help, and they confirmed that PostgreSQL on Linux doesn't support
> Windows clients with Active Directory.

That's not correct and I'm sorry to hear that there has been confusion
and misinformation about that.  PostgreSQL on Linux will absolutely work
with Windows clients and I've run it both with a keytab created by a
Windows KDC and by having a cross-realm trust to a MIT KDC.  Note that,
on Linux, you use the GSS authentication mechanism, not SSPI, but those
are (more-or-less, see below) wireline compatible.

> If someone has been able to make it work, I'd love to hear how.

One of the issues which can trip someone up in such a configuration is
that Windows and Linux differ in the principal requested/used- Windows
will default to POSTGRES/f.q.d.n@REALM.COM while Linux is
postgres/f.q.d.n@REALM.COM and, yes, case matters.  You can also get
into a bit of trouble with the actual principals (Windows is a bit dumb
when it comes to how it deals with case- in particular, I've seen it
happily accept whatever case the user logged into the box with and stick
that into the TGT, so you may have to deal with that in the pg_ident
mapping file).

For my 2c, unless you've got just one PG server or one service in your
environment, it's easier to have a different realm for the Unix-based
resources with an MIT KDC and a cross-realm (which can be one-way) trust
=66rom the AD environment where the users log in to the Unix realm which
PG, SSH, Apache w/ mod_auth_krb, etc, exist.  Setting up an MIT KDC is
pretty straight-forward and it's definitely easier to test PG
kerberos-based auth when everything is on Linux first, get it all
working, and then adding the cross-realm trust is pretty easy, as is
supporting the Windows users in the other realm.  Getting basic
Kerberos going is usually the more difficult piece because it's a bit
involved and not something many people are used to doing these days.

Thanks!

	Stephen

> On Sat, Mar 7, 2015 at 8:57 AM, Stephen Frost <sfrost@snowman.net> wrote:
>=20
> > Jay,,
> >
> > * John Scalia (jayknowsunix@gmail.com) wrote:
> > > A new federal related project has asked me if PostgreSQL can
> > authenticate a user using Active Directory or LDAP. I've never used eit=
her
> > of these and therefore have no real idea.
> > > Hence, my question. Is there a way to use either of these technologies
> > to authenticate a user?
> >
> > The short answer is yes.  Active Directory uses Kerberos for
> > authentication, which PostgreSQL supports through the GSS authentication
> > mechanism.
> >
> > LDAP authentication is also supported but is strongly discouraged in an
> > Active Directory environment (by Microsoft) as Kerberos should be used
> > instead since it's a much more secure solution.  LDAP-based
> > authentication requires sending the password to PG as cleartext.
> >
> >         Thanks!
> >
> >                 Stephen
> >

--XfQyFtxChl4bBa/T
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJU+w3cAAoJEO1sijiDR2RV99IQAK27e8fc8MmaPV/iNz5epBq8
Tm8b4rK87+h8VkZi3Qf+6JQnnDIiaCSYL4iYCZ0/9GsPsyUTOyC6PWrMv9OQ/B2Y
xD20DQ747hfmhLaPI4n3uMcV7znET02r+58ucYqsBAxQevGrJt1YGN52DUrnYTTj
pWvEG3lzIp9Sr/jbNdjgSGAM+DhGp9S6EwwTFWTUEZbCUk7ECtQPU4BG7pE6OliP
vUgS/hq2pv2ef4j66mdu8WjBMc0arX+nziD00yTyhF9lZltfqhGNL/x5gqE6PJD9
6We2DxTymkJqEsIc4ooc49KUL3V6br9g1LPUfWGGUGb14GcMyRuNSsDW6Jpvbscu
ptLBQvxXQwZVQjhy7sPtJsG9QcjNMaTuC2l/+v8ORD86wjdg8nZAvy6mv8euuHMb
R/NPToV0FcGcCenJD4I53GqlOACF1Jzg0J6/TUQkXVOTA1R8t9+SpGfsgjCmdXUe
Azjo9HZkAz62cG+rbadCgWFOXdKnOjG5MCHX5ZE1GiKGfQEr+Q/qRL0C3Q7FnQQJ
i0rsUw1ThhlFlqQoamKdvf52/Jh97vkLU/3+FTfD60YhjCL+9rx7Ud6mu9hVUG18
ACNqdMSDfDZgE/twB4surLAM1yHMdZ8Mqa3XJb2Pu/gMV95qJj34W8YNEN5bCztY
98jrZGfnnsjQLnomPI5d
=LuF+
-----END PGP SIGNATURE-----

--XfQyFtxChl4bBa/T--