Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1b9uIH-0006JF-8W for pgsql-admin@arkaria.postgresql.org; Mon, 06 Jun 2016 13:10:13 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84_2) (envelope-from ) id 1b9uIG-0006uc-Ro for pgsql-admin@arkaria.postgresql.org; Mon, 06 Jun 2016 13:10:12 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1b9uIG-0006to-De for pgsql-admin@postgresql.org; Mon, 06 Jun 2016 13:10:12 +0000 Received: from tamriel.snowman.net ([72.66.115.51]) by makus.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1b9uIE-0000gd-1C for pgsql-admin@postgresql.org; Mon, 06 Jun 2016 13:10:11 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 72C885F796; Mon, 6 Jun 2016 09:09:09 -0400 (EDT) Date: Mon, 6 Jun 2016 09:09:09 -0400 From: Stephen Frost To: Bear Giles Cc: "Weingartner, Steven" , "pgsql-admin@postgresql.org" Subject: Re: GSSAPI / Kerberos Authentication Message-ID: <20160606130909.GJ21416@tamriel.snowman.net> References: <54213787d7c441bb9981e2e031709aa5@MS-EX13RB-P007.corp.SE.sempra.com> <09818804b4f547eab26ee29fba47932f@MS-EX13RB-P007.corp.SE.sempra.com> <20160603001835.GA21416@tamriel.snowman.net> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="1ZSqOBn16zpYZVlF" Content-Disposition: inline In-Reply-To: X-Editor: Vim http://www.vim.org/ X-Info: http://www.snowman.net X-Operating-System: Linux/3.13.0-77-generic (x86_64) X-Uptime: 09:06:06 up 104 days, 9:58, 38 users, load average: 0.12, 0.12, 0.13 User-Agent: Mutt/1.5.21 (2010-09-15) X-Pg-Spam-Score: -3.3 (---) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-admin Precedence: bulk Sender: pgsql-admin-owner@postgresql.org --1ZSqOBn16zpYZVlF Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Bear, * Bear Giles (bgiles@coyotesong.com) wrote: > The problem is connecting to the server using the JDBC driver. It currently > uses the connection username and password to log into the KDC and also > provides the username to the database. That works fine with a simple > username but gets confused with principal names like above. What I plan to > add is the ability to specify a keytab instead of the username and password > for the JDBC driver. I banged my head against the wall for awhile before > downloading the code and single-stepping through the login process. :-) Doesn't the JDBC driver have a way to use an existing credential cache though..? Generally speaking, one uses something like k5start to initialize (and keep current) a credential cache by using a keytab and then the daemon (or what-have-you) uses that. The JDBC driver really shouldn't be accepting the username/password at all.. Thanks! Stephen --1ZSqOBn16zpYZVlF Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJXVXX0AAoJEO1sijiDR2RVCpAP/iWGUVD0O4ig9Juti2VCKLir uraIKi/ZoEpPsEk07zr/82tcEbUIQ3NSk0vInH9gHK4kTF/Pe1fYULMB7PGCwGC0 6cF54LEIRRAA7PKC6m6rnroOFuYwcxxSnOuK7ci77CklmYEOTmCjAaN/lHNs6/tg zqFgZL1ff2DEYZOCHpT8l8+ovBeNJf1MB+3N0b/ayi90HT6tH2V/lxJHIsbgsep4 W/J5Sn/u4Xet+/HRzAiaUEycX1YumFnVpBp5aPh6A9MKAMZSWx+7hVPXwEL12sWI YW/nmNA+C3lhQci7GN13wJIjSOlQZjdXGwHCevXUsZyr+VacwbDBFlMIEXuA8PuA dMZSuL2vLYKVAUwSj1hPLl56i7r+qsn9lU9hhwWxXz9n6Qy6kg1o7WGNKuBbx0vH TUwUTNuFmBdJUFsG27HRJKCD66UGBmRwtOBo5JyQzyT9o9GYh7aVrnccRG+E7RE5 HEYCahLnfDo1lX1ysjINzEKmhm1uy8FoML6ry+lhgmm4v0+mu1YlBxwocmyi7Kqo mHB81cmEpf0YeUe96UXWLznMN46drxYMo2Ga62JGjHIvfMPg5OB/ezkzuw4fd8S9 /9/qVG/MUV5/LS3qT+VYtLzJ13vH0f5RrCCrrLn71Fwj3BQTQu2/RJRbptC0KrH2 0sVxmLlL0+l3g3lIa9y/ =YHig -----END PGP SIGNATURE----- --1ZSqOBn16zpYZVlF--