From: Stephen Frost <sfrost@snowman.net>
To: Sathesh S <sathesh.sundaram@hotmail.com>
Cc: pgsql-admin@postgresql.org <pgsql-admin@postgresql.org>
Subject: Re: Disable /Suppress hostname checks while secured LDAP
Date: Wed, 14 Feb 2018 09:21:06 -0500
Message-ID: <20180214142106.GA2416@tamriel.snowman.net> (raw)
In-Reply-To: <DB6PR10MB1846529979DDF09DE728FE2D82F50@DB6PR10MB1846.EURPRD10.PROD.OUTLOOK.COM>
References: <DB6PR10MB1846529979DDF09DE728FE2D82F50@DB6PR10MB1846.EURPRD10.PROD.OUTLOOK.COM>
Greetings,
* Sathesh S (sathesh.sundaram@hotmail.com) wrote:
> Is there a way to disable/suppress hostname checks in while using Secured LDAP in postgreSQL for authentication.
>
> The issue what we have is that the LDAP certificate what we are using is working for fully qualified named of the domain but not when we use a direct LDAP server in the pg_ba.conf file.
>
> For example:
> This works - ldapserver="ldaps//dummy.company.com"
>
> This doesnt work - ldapserver="server1.dummy.company.com"
>
> Our internal LDAP team says that we nees to disable/suppress the hostname checking on the postgreSQL side for the 2nd option to work.
>
> Does anyone have an idea on how we can suppress hostnames check while using Secured LDAP.
This really isn't recommended because the point of the hostname check is
to verify that you're actually talking to the server you intended to.
What LDAP server are you using though..? If this is in an Active
Directory environment, or any environment where you have Kerberos
available, then you should be using Kerberos and *not* using LDAP (or
even LDAPS) for authentication as it isn't nearly as secure.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, sathesh.sundaram@hotmail.com
Subject: Re: Disable /Suppress hostname checks while secured LDAP
In-Reply-To: <20180214142106.GA2416@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox