Date: Fri, 23 Nov 2018 10:17:25 -0500
From: Stephen Frost <sfrost@snowman.net>
To: "Lentes, Bernd" <bernd.lentes@helmholtz-muenchen.de>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: User Authentication: LDAP and "local" accounts concurrently ?
Message-ID: <20181123151725.GH3415@tamriel.snowman.net>
References: 
 <1819852155.20922807.1542983802608.JavaMail.zimbra@helmholtz-muenchen.de>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="ISYO4r/TCluGLnhR"
Content-Disposition: inline
In-Reply-To: 
 <1819852155.20922807.1542983802608.JavaMail.zimbra@helmholtz-muenchen.de>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--ISYO4r/TCluGLnhR
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Greetings,

* Lentes, Bernd (bernd.lentes@helmholtz-muenchen.de) wrote:
> i created a Postgres Server 9.6 on a SLES 12 SP3 box. In our institution we have a Windows ADS which i like to use to authenticate users via LDAP.

For running PostgreSQL in a Windows ADS environment, you should really
be using GSSAPI / Kerberos and *not* using LDAP authentication.

GSSAPI / Kerberos is what Windows uses to authenticate users and
services and it's much more secure than using LDAP.

> Is it possible to use both concurrently ? Some users autheticate via LDAP, others local.

As Tom mentioned, you can have two pg_hba.conf entries.  For what you're
doing, it seems like maybe you would have a 'local user' group which
comes first in pg_hba.conf and is a role that all local users are a
member of, and then you could have a second entry that is 'all' users,
so you don't have to have every user in the active directory environment
in a group in the database.

Thanks!

Stephen

--ISYO4r/TCluGLnhR
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJb+BoFAAoJEO1sijiDR2RVFQ8P/0dl8Qu/p4iPXvKwSYOcYt6t
+joeTUNeeYGTYacE9UxOXJnJ8Ls4SU7sVkwIa2yRUVIkqDGL3ildND0fGTdn89Om
8tMxttWXMVIZ65T422NOfmDceGUORNVfoKp1CRxAcYMB+qWKopVWJtNIxGr+CMZY
hQTs7zHV0G7T5jOLgBHborizO0CbN0sseQi1JIGnfP9rU4K+AXpkhlSiDnRHLXjl
aM2jSHSkcIKl3GPC8ogMge3d2WKb6mBwvYP2ifBKgDl1U2sFgETL+zNzpUe5EwC3
31idp41V87I1VZGJWbkpfFvUBZUSX32oYDXQPOJEye/xre686+XlR8HwhUrgt88z
+rNhwsRCwPWnguZtuRqZnUMSv63teKJds6yikaX11QYsIEF1qBrO6h6NkVcl1k49
36c/h4KTy8nknTIp+u6b59PKL9tWVXj1k7c9M8/p8+1KZGa37DNlj2SEPTMzQHEM
SpZhXBuRKUFjEkyBgz9cdLV8pp88wXTQMf71M9VsgwZ9DMvfhawD0tKaAVJBcZKf
cUuIOlchsXi+5nTx9olqJ3C2mjSckM22Pt18q0R/fmeb/hPYLm/05LNVSvG1elvl
dO8Q9HAFXOsI8/Uf9em4rivED/MfUGW/sn4h55GZ6FZauNzjpTNWiYyBPULEZp5l
Ul9UAueepndoyPaq7T3f
=I0K3
-----END PGP SIGNATURE-----

--ISYO4r/TCluGLnhR--