From: Stephen Frost <sfrost@snowman.net>
To: Bear Giles <bgiles@coyotesong.com>
Cc: Weingartner, Steven <SWeingartner@semprautilities.com>
Cc: pgsql-admin@postgresql.org <pgsql-admin@postgresql.org>
Subject: Re: GSSAPI / Kerberos Authentication
Date: Mon, 6 Jun 2016 09:09:09 -0400
Message-ID: <20160606130909.GJ21416@tamriel.snowman.net> (raw)
In-Reply-To: <CALBNtw5tXpqE1bY=Q6Ysi-84UJRO4Y5hcm8F=H9xk0_7+TzZxQ@mail.gmail.com>
References: <54213787d7c441bb9981e2e031709aa5@MS-EX13RB-P007.corp.SE.sempra.com>
<CALBNtw6g_AvmX11G8WaEfJHj2h4eJgPT3NNFenNit_8v35r3ow@mail.gmail.com>
<09818804b4f547eab26ee29fba47932f@MS-EX13RB-P007.corp.SE.sempra.com>
<CALBNtw7AitdWubT7B9taeSD755hk7Tzntq+eunj32p9xF07T2g@mail.gmail.com>
<20160603001835.GA21416@tamriel.snowman.net>
<CALBNtw5tXpqE1bY=Q6Ysi-84UJRO4Y5hcm8F=H9xk0_7+TzZxQ@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
Bear,
* Bear Giles (bgiles@coyotesong.com) wrote:
> The problem is connecting to the server using the JDBC driver. It currently
> uses the connection username and password to log into the KDC and also
> provides the username to the database. That works fine with a simple
> username but gets confused with principal names like above. What I plan to
> add is the ability to specify a keytab instead of the username and password
> for the JDBC driver. I banged my head against the wall for awhile before
> downloading the code and single-stepping through the login process. :-)
Doesn't the JDBC driver have a way to use an existing credential cache
though..? Generally speaking, one uses something like k5start to
initialize (and keep current) a credential cache by using a keytab and
then the daemon (or what-have-you) uses that.
The JDBC driver really shouldn't be accepting the username/password at
all..
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, bgiles@coyotesong.com, SWeingartner@semprautilities.com
Subject: Re: GSSAPI / Kerberos Authentication
In-Reply-To: <20160606130909.GJ21416@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox