Date: Thu, 2 Jun 2016 20:18:35 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Bear Giles <bgiles@coyotesong.com>
Cc: "Weingartner, Steven" <SWeingartner@semprautilities.com>,
	"pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
Subject: Re: GSSAPI / Kerberos Authentication
Message-ID: <20160603001835.GA21416@tamriel.snowman.net>
References: 
 <54213787d7c441bb9981e2e031709aa5@MS-EX13RB-P007.corp.SE.sempra.com>
 <CALBNtw6g_AvmX11G8WaEfJHj2h4eJgPT3NNFenNit_8v35r3ow@mail.gmail.com>
 <09818804b4f547eab26ee29fba47932f@MS-EX13RB-P007.corp.SE.sempra.com>
 <CALBNtw7AitdWubT7B9taeSD755hk7Tzntq+eunj32p9xF07T2g@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="qcmJb3WyrQSdDnng"
Content-Disposition: inline
In-Reply-To: 
 <CALBNtw7AitdWubT7B9taeSD755hk7Tzntq+eunj32p9xF07T2g@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org


--qcmJb3WyrQSdDnng
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

All,

* Bear Giles (bgiles@coyotesong.com) wrote:
> I remember reading comments in the code that case matters - postgres and
> POSTGRES are not the same - but I'm drawing a blank on the rest. I just
> started looking at the code myself though - others probably have more
> experience.

That's correct, case absolutely matters and it needs to match.

There are options in postgresql.conf to control what's expected.  This
is a source of common issue when coming from Windows clients to Linux
servers (or the other way around).

In particular, review section 19.3.3 of the 9.5 docs:

https://www.postgresql.org/docs/9.5/static/auth-methods.html#GSSAPI-AUTH

For the client side, review krbsrvname:

https://www.postgresql.org/docs/9.5/static/libpq-connect.html#LIBPQ-PARAMKEYWORDS

Check the klist from the client side and also look at the keytab that's
on the server and what's in the KDC database and make sure they all
match.  What the client asks for from the KDC needs to be what the KDC
has and what is installed in the keytab on the server for it all to
work.

Thanks!

Stephen

--qcmJb3WyrQSdDnng
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJXUMzaAAoJEO1sijiDR2RV8uEQAJXepCl6mgG9lvKUD8oIW04N
aQOwKOhZ1WifGGvlqvwKvlSK99YNb/b1Sq28jfSUNrzn+jmmij3kGZBH1VHRfwEF
yla6OPXQkN1jt43AxGXF3jkpiuQHgSNLv9sKbU/8yzbdJAOiz3D2D2SnFycPpb11
51KDPaRHSBm9B3g3jDV0A8sLwZpoNe2NM+sKvIx+e/2uKzDF2pQFZgJKA4edgk1D
qcJWbXmnde7t7qJUjNkwrv0uxNzOmHCYAKK2uEWYUn/VFdwDiGn6yUXt+KCdasSf
q8nNR6PAqsfI/sqH1tlaTsmJDz8ZnIx0U4vx73D6YW3b+TNqEZZxrhG1V52Jm4Bu
xnN+Yrci2Bvj7ZqcU7vxsTaTHr8TlSQaqaM29bU9X6CQpz01QcXpWgjt4WXPGDRN
VgLzw+dH7KKknaJdcV7jI2CC4V+Gi0ZrqiTIJnFYXPGzCOffO6h94H6GSuQPzF6z
c/iQ2tdc4zRIgKe3ZqANk5B+rC6uoo/rrq4Z7ZC7LY/57o6w/D4vni9cP/ywEdit
UCoyMX+o2rUHvqGVuKTu2dbSOhGr0+sHr9I1eyGvlpu7bFaUDcDxdFF3RpCOK4Ps
X88erlVh6NxZSHtrVGZNh4cdaku4gBxg4RWa00d+ujfyzbq5j/oUkDn/sES1ZTBQ
j6JlcLeaADTHdNpQtnc3
=O9Ku
-----END PGP SIGNATURE-----

--qcmJb3WyrQSdDnng--