pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedPostgres user authentication with secure LDAP
8+ messages / 6 participants
[nested] [flat]
* Postgres user authentication with secure LDAP
@ 2017-08-10 21:02 Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>
0 siblings, 2 replies; 8+ messages in thread
From: Tang, Ronald K CIV FNMOC, N6 @ 2017-08-10 21:02 UTC (permalink / raw)
To: pgsql-admin
Hi,
I am trying to configure my Postgres server to use LDAP for authentication. My pg_hba.conf config line is:
ldap ldapserver=ldaps://myldaps.company.com ldapport=636 ldaptls=1 ldapprefix="uid=" ldapsuffix=",ou=People,o=my.company.com"
I queried the LDAP server successfully with the 'ldapsearch' tool with the same DN. However, I cannot get it to work successfully on Postgres. I have ssl=on and all server and CA certs installed.
Postgres version 9.5.6.
Error log:
could not initialize LDAP: No such file or directory
LDAP authentication failed for user "user1"
auth_failed, auth.c:288
---------------------------------------
Thanks for any helps.
Ron
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: Postgres user authentication with secure LDAP
@ 2017-08-10 21:57 Jeffrey Shaw <shawjef3@gmail.com>
parent: Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>
1 sibling, 2 replies; 8+ messages in thread
From: Jeffrey Shaw @ 2017-08-10 21:57 UTC (permalink / raw)
To: Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>; +Cc: pgsql-admin
Hi Ron,
What OS is your server running, and what OS is your client running?
I found that it was only possible to get clients from a Windows machine to
authenticate via ldap against a server that was also running Windows.
Hopefully someone else has more experience here than me.
On Thu, Aug 10, 2017 at 5:02 PM, Tang, Ronald K CIV FNMOC, N6 <
ronald.k.tang@navy.mil> wrote:
> Hi,
>
> I am trying to configure my Postgres server to use LDAP for
> authentication. My pg_hba.conf config line is:
>
> ldap ldapserver=ldaps://myldaps.company.com ldapport=636 ldaptls=1
> ldapprefix="uid=" ldapsuffix=",ou=People,o=my.company.com"
>
> I queried the LDAP server successfully with the 'ldapsearch' tool with the
> same DN. However, I cannot get it to work successfully on Postgres. I have
> ssl=on and all server and CA certs installed.
>
> Postgres version 9.5.6.
>
> Error log:
>
> could not initialize LDAP: No such file or directory
> LDAP authentication failed for user "user1"
> auth_failed, auth.c:288
>
> ---------------------------------------
> Thanks for any helps.
> Ron
>
>
>
> --
> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-admin
>
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: Postgres user authentication with secure LDAP
@ 2017-08-10 22:00 Scott Whitney <scott@journyx.com>
parent: Jeffrey Shaw <shawjef3@gmail.com>
1 sibling, 0 replies; 8+ messages in thread
From: Scott Whitney @ 2017-08-10 22:00 UTC (permalink / raw)
To: Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>; Jeffrey Shaw <shawjef3@gmail.com>; +Cc: pgsql-admin
Well, first off, you're on the wrong port for LDAPS://
________________________________
From: pgsql-admin-owner@postgresql.org <pgsql-admin-owner@postgresql.org> on behalf of Jeffrey Shaw <shawjef3@gmail.com>
Sent: Thursday, August 10, 2017 4:57:51 PM
To: Tang, Ronald K CIV FNMOC, N6
Cc: pgsql-admin@postgresql.org
Subject: Re: [ADMIN] Postgres user authentication with secure LDAP
Hi Ron,
What OS is your server running, and what OS is your client running?
I found that it was only possible to get clients from a Windows machine to authenticate via ldap against a server that was also running Windows. Hopefully someone else has more experience here than me.
On Thu, Aug 10, 2017 at 5:02 PM, Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil<mailto:ronald.k.tang@navy.mil>> wrote:
Hi,
I am trying to configure my Postgres server to use LDAP for authentication. My pg_hba.conf config line is:
ldap ldapserver=ldaps://myldaps.company.com<http://myldaps.company.com; ldapport=636 ldaptls=1 ldapprefix="uid=" ldapsuffix=",ou=People,o=my.company.com<http://my.company.com>";
I queried the LDAP server successfully with the 'ldapsearch' tool with the same DN. However, I cannot get it to work successfully on Postgres. I have ssl=on and all server and CA certs installed.
Postgres version 9.5.6.
Error log:
could not initialize LDAP: No such file or directory
LDAP authentication failed for user "user1"
auth_failed, auth.c:288
---------------------------------------
Thanks for any helps.
Ron
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org<mailto:pgsql-admin@postgresql.org>)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
Journyx, Inc.
7600 Burnet Road #300
Austin, TX 78757
www.journyx.com
p 512.834.8888
f 512-834-8858
Do you receive our promotional emails? Click here <http://journyx.com/communication-preferences; or visit http://journyx.com/communication-preferences to unsubscribe.
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: Postgres user authentication with secure LDAP
@ 2017-08-11 01:53 Stephen Frost <sfrost@snowman.net>
parent: Jeffrey Shaw <shawjef3@gmail.com>
1 sibling, 0 replies; 8+ messages in thread
From: Stephen Frost @ 2017-08-11 01:53 UTC (permalink / raw)
To: Jeffrey Shaw <shawjef3@gmail.com>; +Cc: Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>; pgsql-admin
Greetings,
* Jeffrey Shaw (shawjef3@gmail.com) wrote:
> What OS is your server running, and what OS is your client running?
Good question.
> I found that it was only possible to get clients from a Windows machine to
> authenticate via ldap against a server that was also running Windows.
> Hopefully someone else has more experience here than me.
That shouldn't be the case, so I'm curious as to what was going on
there..
That said, I'd strongly recommend using GSSAPI/Kerberos if the
environment is a Windows Active Directory one, as it's much more secure
and works quite well.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: Postgres user authentication with secure LDAP
@ 2017-08-11 03:04 Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
parent: Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>
1 sibling, 1 reply; 8+ messages in thread
From: Peter Eisentraut @ 2017-08-11 03:04 UTC (permalink / raw)
To: Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>; pgsql-admin
On 8/10/17 17:02, Tang, Ronald K CIV FNMOC, N6 wrote:
> I am trying to configure my Postgres server to use LDAP for authentication. My pg_hba.conf config line is:
>
> ldap ldapserver=ldaps://myldaps.company.com ldapport=636 ldaptls=1 ldapprefix="uid=" ldapsuffix=",ou=People,o=my.company.com"
The ldapserver= attribute takes a host name, not a URL.
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: [Non-DoD Source] Re: Postgres user authentication with secure LDAP
@ 2017-08-11 16:00 Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>
parent: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
0 siblings, 2 replies; 8+ messages in thread
From: Tang, Ronald K CIV FNMOC, N6 @ 2017-08-11 16:00 UTC (permalink / raw)
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>; pgsql-admin
I am responding to all replies in this single email. Thanks for all your response.
>> The ldapserver= attribute takes a host name, not a URL.
Thanks. I tried that too. If I omit the ldaps:// the response is server not found.
>> What OS is your server running, and what OS is your client running?
RedHat Linux (RHEL 6), both client and server. Postgres 9.5.6
>> Well, first off, you're on the wrong port for LDAPS://
Default port for LDAPS:// is 636. I verified with "ldapsearch" tool that it works with that port.
Thanks,
Ron
-----Original Message-----
From: Peter Eisentraut [mailto:peter.eisentraut@2ndquadrant.com]
Sent: Thursday, August 10, 2017 8:05 PM
To: Tang, Ronald K CIV FNMOC, N6; pgsql-admin@postgresql.org
Subject: [Non-DoD Source] Re: [ADMIN] Postgres user authentication with secure LDAP
On 8/10/17 17:02, Tang, Ronald K CIV FNMOC, N6 wrote:
> I am trying to configure my Postgres server to use LDAP for authentication. My pg_hba.conf config line is:
>
> ldap ldapserver=ldaps://myldaps.company.com ldapport=636 ldaptls=1 ldapprefix="uid=" ldapsuffix=",ou=People,o=my.company.com"
The ldapserver= attribute takes a host name, not a URL.
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
Attachments:
smime.p7s (application/pkcs7-signature, 5.2K) download
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: [Non-DoD Source] Re: Postgres user authentication with secure LDAP
@ 2017-08-11 18:07 Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>
parent: Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>
1 sibling, 0 replies; 8+ messages in thread
From: Tang, Ronald K CIV FNMOC, N6 @ 2017-08-11 18:07 UTC (permalink / raw)
To: pgsql-admin
https://www.postgresql.org/docs/9.5/static/auth-methods.html#AUTH-LDAP
"The ldaps URL scheme (direct SSL connection) is not supported."
It doesn't appear "LDAPS" is supported in Postgres 9.5.
________________________________________
From: pgsql-admin-owner@postgresql.org [pgsql-admin-owner@postgresql.org] on behalf of Tang, Ronald K CIV FNMOC, N6 [ronald.k.tang@navy.mil]
Sent: Friday, August 11, 2017 9:00 AM
To: 'Peter Eisentraut'; 'pgsql-admin@postgresql.org'
Subject: Re: [Non-DoD Source] Re: [ADMIN] Postgres user authentication with secure LDAP
I am responding to all replies in this single email. Thanks for all your response.
>> The ldapserver= attribute takes a host name, not a URL.
Thanks. I tried that too. If I omit the ldaps:// the response is server not found.
>> What OS is your server running, and what OS is your client running?
RedHat Linux (RHEL 6), both client and server. Postgres 9.5.6
>> Well, first off, you're on the wrong port for LDAPS://
Default port for LDAPS:// is 636. I verified with "ldapsearch" tool that it works with that port.
Thanks,
Ron
-----Original Message-----
From: Peter Eisentraut [mailto:peter.eisentraut@2ndquadrant.com]
Sent: Thursday, August 10, 2017 8:05 PM
To: Tang, Ronald K CIV FNMOC, N6; pgsql-admin@postgresql.org
Subject: [Non-DoD Source] Re: [ADMIN] Postgres user authentication with secure LDAP
On 8/10/17 17:02, Tang, Ronald K CIV FNMOC, N6 wrote:
> I am trying to configure my Postgres server to use LDAP for authentication. My pg_hba.conf config line is:
>
> ldap ldapserver=ldaps://myldaps.company.com ldapport=636 ldaptls=1 ldapprefix="uid=" ldapsuffix=",ou=People,o=my.company.com"
The ldapserver= attribute takes a host name, not a URL.
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: [Non-DoD Source] Re: Postgres user authentication with secure LDAP
@ 2017-08-11 18:42 Armin Resch <reschab@gmail.com>
parent: Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>
1 sibling, 0 replies; 8+ messages in thread
From: Armin Resch @ 2017-08-11 18:42 UTC (permalink / raw)
To: Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>; +Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>; pgsql-admin
>> Default port for LDAPS:// is 636. I verified with "ldapsearch" tool
that it works with that port.
Odd, in my integration work b/w Apache on Linux and Windows AD, it didn't
work well with port 636. Yet, it did work well with port 3269.
Cheers,
-ar
On Fri, Aug 11, 2017 at 12:00 PM, Tang, Ronald K CIV FNMOC, N6 <
ronald.k.tang@navy.mil> wrote:
> I am responding to all replies in this single email. Thanks for all your
> response.
>
> >> The ldapserver= attribute takes a host name, not a URL.
> Thanks. I tried that too. If I omit the ldaps:// the response is server
> not found.
>
> >> What OS is your server running, and what OS is your client running?
> RedHat Linux (RHEL 6), both client and server. Postgres 9.5.6
>
> >> Well, first off, you're on the wrong port for LDAPS://
> Default port for LDAPS:// is 636. I verified with "ldapsearch" tool that
> it works with that port.
>
> Thanks,
> Ron
>
> -----Original Message-----
> From: Peter Eisentraut [mailto:peter.eisentraut@2ndquadrant.com]
> Sent: Thursday, August 10, 2017 8:05 PM
> To: Tang, Ronald K CIV FNMOC, N6; pgsql-admin@postgresql.org
> Subject: [Non-DoD Source] Re: [ADMIN] Postgres user authentication with
> secure LDAP
>
> On 8/10/17 17:02, Tang, Ronald K CIV FNMOC, N6 wrote:
> > I am trying to configure my Postgres server to use LDAP for
> authentication. My pg_hba.conf config line is:
> >
> > ldap ldapserver=ldaps://myldaps.company.com ldapport=636 ldaptls=1
> ldapprefix="uid=" ldapsuffix=",ou=People,o=my.company.com"
>
> The ldapserver= attribute takes a host name, not a URL.
>
> --
> Peter Eisentraut http://www.2ndQuadrant.com/
> PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
>
^ permalink raw reply [nested|flat] 8+ messages in thread
end of thread, other threads:[~2017-08-11 18:42 UTC | newest]
Thread overview: 8+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2017-08-10 21:02 Postgres user authentication with secure LDAP Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>
2017-08-10 21:57 ` Jeffrey Shaw <shawjef3@gmail.com>
2017-08-10 22:00 ` Scott Whitney <scott@journyx.com>
2017-08-11 01:53 ` Stephen Frost <sfrost@snowman.net>
2017-08-11 03:04 ` Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
2017-08-11 16:00 ` Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>
2017-08-11 18:07 ` Tang, Ronald K CIV FNMOC, N6 <ronald.k.tang@navy.mil>
2017-08-11 18:42 ` Armin Resch <reschab@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox