From: Stephen Frost <sfrost@snowman.net>
To: Lentes, Bernd <bernd.lentes@helmholtz-muenchen.de>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: User Authentication: LDAP and "local" accounts concurrently ?
Date: Fri, 23 Nov 2018 10:17:25 -0500
Message-ID: <20181123151725.GH3415@tamriel.snowman.net> (raw)
In-Reply-To: <1819852155.20922807.1542983802608.JavaMail.zimbra@helmholtz-muenchen.de>
References: <1819852155.20922807.1542983802608.JavaMail.zimbra@helmholtz-muenchen.de>
Greetings,
* Lentes, Bernd (bernd.lentes@helmholtz-muenchen.de) wrote:
> i created a Postgres Server 9.6 on a SLES 12 SP3 box. In our institution we have a Windows ADS which i like to use to authenticate users via LDAP.
For running PostgreSQL in a Windows ADS environment, you should really
be using GSSAPI / Kerberos and *not* using LDAP authentication.
GSSAPI / Kerberos is what Windows uses to authenticate users and
services and it's much more secure than using LDAP.
> Is it possible to use both concurrently ? Some users autheticate via LDAP, others local.
As Tom mentioned, you can have two pg_hba.conf entries. For what you're
doing, it seems like maybe you would have a 'local user' group which
comes first in pg_hba.conf and is a role that all local users are a
member of, and then you could have a second entry that is 'all' users,
so you don't have to have every user in the active directory environment
in a group in the database.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, bernd.lentes@helmholtz-muenchen.de, pgsql-admin@lists.postgresql.org
Subject: Re: User Authentication: LDAP and "local" accounts concurrently ?
In-Reply-To: <20181123151725.GH3415@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox