Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1ejX7F-0003nv-NT for pgsql-admin@arkaria.postgresql.org; Wed, 07 Feb 2018 21:18:53 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ejX7E-0007Yl-Hz for pgsql-admin@arkaria.postgresql.org; Wed, 07 Feb 2018 21:18:52 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1ejX7E-0007YW-7m; Wed, 07 Feb 2018 21:18:52 +0000 Received: from tamriel.snowman.net ([96.255.250.162]) by makus.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1ejX7B-0003Xe-LS; Wed, 07 Feb 2018 21:18:50 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 565CF5F79C; Wed, 7 Feb 2018 16:18:48 -0500 (EST) Date: Wed, 7 Feb 2018 16:18:48 -0500 From: Stephen Frost To: John Scalia Cc: Azimuddin Mohammed , pgsql-admin@postgresql.org, pgsql-general@postgresql.org, pgsql-admin@lists.postgresql.org Subject: Re: LDAP for postgres Message-ID: <20180207211848.GV2416@tamriel.snowman.net> References: <5477B879-8164-4EB7-A145-46215530B81A@gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="T/hsnsCXUexHiAmW" Content-Disposition: inline In-Reply-To: <5477B879-8164-4EB7-A145-46215530B81A@gmail.com> User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --T/hsnsCXUexHiAmW Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Greetings, Please don't top-post. I'd also suggest not cross-posting. * John Scalia (jayknowsunix@gmail.com) wrote: > You=E2=80=99ll need to setup your pg_hba.conf file for LDAP. There are se= veral different ways to do this, but a lot depends on how your LDAP server = is setup. It=E2=80=99s impossible to really accurately say what you=E2=80= =99ll need in that file. If you are working in an Active Directory environment, you should really be using Kerberos/GSSAPI, not LDAP. This is done by specifying 'gssapi' in your pg_hba.conf. Using LDAP for auth isn't secure and isn't necessary in an Active Directory environment. If you are running an LDAP-only environment then you should really be considering deployment of a proper authentication system, such as MIT Kerberos or Heimdal Kerberos. Thanks! Stephen --T/hsnsCXUexHiAmW Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJae204AAoJEO1sijiDR2RVxvAP+gKSwWy6x4OgNrE3ljivur9N oMFv1tuWUHxzLWpm585c+hqr5nEjO7qZyNTbOlzoY5TIx4YB8HwWukT/fLrQYSuz 4PLu0tczFF31dAz5oGfGI2JR6t8+ikUsUeVVAFCrrGvlogxqk3rXwidY1ass67dX WJlq+Fh4IZ6JwmuaoZx/yXViSNxA78DcvBUNPQvo/ZZ3dChL0GkhGAm9ZpLndnoL gqB+x+WCgsi9OSL9GsnOHYZL7852armA4P6P3/m6GhqIHTO9OwXbAl4/KIQhT3Zs yjOs581nCIwwse4244M8/RVYeE+iytrOIFHosavsi/AUQ4VQbKNTr+prLFyv+qWe uYnw63epD5H+O8s0QXesvpind2VY2kF8qoGPNbwcfUl4KDaJbd2DGRXp2WNjDqDf or8a5wmoRldVWkBuAayUmNKbULFUuQe6G6sY8jgtV4RIzboYDk6h24Ncg/KkB8Wp yOogZys59TCLpSjoUluKdLiN6YeSivgmR8th0aCDTyCtq2JOgtoSoTn9JbhQSEcd Pau/sXG8Fjff3P9tJp2lgRM5z7m2XhJiaqgws3zv73/UbmV4zqw05vo5NlmmjZPZ O5nvnnt4wON/hsKYQpCMKwL7DpLqtQZg8pYdl/H7/cICtvdU1AQCvGrkW8j3AeUc 7w9aP9iN7oHcG1948v96 =x16w -----END PGP SIGNATURE----- --T/hsnsCXUexHiAmW--