pg.ddx.io  pgsql-admin@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Stephen Frost <sfrost@snowman.net>
To: Bear Giles <bgiles@coyotesong.com>
Cc: Weingartner, Steven <SWeingartner@semprautilities.com>
Cc: pgsql-admin@postgresql.org <pgsql-admin@postgresql.org>
Subject: Re: GSSAPI / Kerberos Authentication
Date: Thu, 2 Jun 2016 20:18:35 -0400
Message-ID: <20160603001835.GA21416@tamriel.snowman.net> (raw)
In-Reply-To: <CALBNtw7AitdWubT7B9taeSD755hk7Tzntq+eunj32p9xF07T2g@mail.gmail.com>
References: <54213787d7c441bb9981e2e031709aa5@MS-EX13RB-P007.corp.SE.sempra.com>
	<CALBNtw6g_AvmX11G8WaEfJHj2h4eJgPT3NNFenNit_8v35r3ow@mail.gmail.com>
	<09818804b4f547eab26ee29fba47932f@MS-EX13RB-P007.corp.SE.sempra.com>
	<CALBNtw7AitdWubT7B9taeSD755hk7Tzntq+eunj32p9xF07T2g@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>

All,

* Bear Giles (bgiles@coyotesong.com) wrote:
> I remember reading comments in the code that case matters - postgres and
> POSTGRES are not the same - but I'm drawing a blank on the rest. I just
> started looking at the code myself though - others probably have more
> experience.

That's correct, case absolutely matters and it needs to match.

There are options in postgresql.conf to control what's expected.  This
is a source of common issue when coming from Windows clients to Linux
servers (or the other way around).

In particular, review section 19.3.3 of the 9.5 docs:

https://www.postgresql.org/docs/9.5/static/auth-methods.html#GSSAPI-AUTH

For the client side, review krbsrvname:

https://www.postgresql.org/docs/9.5/static/libpq-connect.html#LIBPQ-PARAMKEYWORDS

Check the klist from the client side and also look at the keytab that's
on the server and what's in the KDC database and make sure they all
match.  What the client asks for from the KDC needs to be what the KDC
has and what is installed in the keytab on the server for it all to
work.

Thanks!

Stephen

Attachments:

  signature.asc (application/pgp-signature, 818B) download

view thread (7+ messages)  latest in thread

Message-ID: <20160603001835.GA21416@tamriel.snowman.net>
Permalink:  ../20160603001835.GA21416@tamriel.snowman.net/
Also on:    postgresql.org/message-id/20160603001835.GA21416@tamriel.snowman.net

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-admin@postgresql.org
  Cc: sfrost@snowman.net, bgiles@coyotesong.com, SWeingartner@semprautilities.com
  Subject: Re: GSSAPI / Kerberos Authentication
  In-Reply-To: <20160603001835.GA21416@tamriel.snowman.net>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox