Date: Fri, 23 Nov 2018 14:14:13 -0500
From: Stephen Frost <sfrost@snowman.net>
To: "Lentes, Bernd" <bernd.lentes@helmholtz-muenchen.de>
Cc: pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: User Authentication: LDAP and "local" accounts concurrently ?
Message-ID: <20181123191413.GJ3415@tamriel.snowman.net>
References: 
 <1819852155.20922807.1542983802608.JavaMail.zimbra@helmholtz-muenchen.de>
 <20181123151725.GH3415@tamriel.snowman.net>
 <448603474.21010176.1542999433914.JavaMail.zimbra@helmholtz-muenchen.de>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="UDq0p1ry40hcSP8u"
Content-Disposition: inline
In-Reply-To: 
 <448603474.21010176.1542999433914.JavaMail.zimbra@helmholtz-muenchen.de>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--UDq0p1ry40hcSP8u
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Lentes, Bernd (bernd.lentes@helmholtz-muenchen.de) wrote:
> ----- On Nov 23, 2018, at 4:17 PM, Stephen Frost sfrost@snowman.net wrote:
> > * Lentes, Bernd (bernd.lentes@helmholtz-muenchen.de) wrote:
> >> i created a Postgres Server 9.6 on a SLES 12 SP3 box. In our instituti=
on we have
> >> a Windows ADS which i like to use to authenticate users via LDAP.
> >=20
> > For running PostgreSQL in a Windows ADS environment, you should really
> > be using GSSAPI / Kerberos and *not* using LDAP authentication.
> >=20
> > GSSAPI / Kerberos is what Windows uses to authenticate users and
> > services and it's much more secure than using LDAP.
>=20
> thanks for your answer. I'm not familiar with LDAP, GSSAPI and Kerberos.
> Why is it more secure ?

With LDAP, the user's password will be seen by the PostgreSQL server,
and sent over the wire in cleartext unless you're making sure to use TLS
on the connection to PG (and if you're doing that you really want to
make sure you have verify-full enabled on your clients....).

With Kerberos/GSSAPI, the authentication tokens are encrypted by the KDC
(in your case, the AD domain controllers) and the user's password is
never exposed.

Thanks!

Stephen

--UDq0p1ry40hcSP8u
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJb+FGFAAoJEO1sijiDR2RV4vQP/jIxuzIrwv7JhyFJKiAStPfa
Y6jPLpod0+derLy5F0V3sbM5J+sjqnt4dXkzMm5oYbWMgPun4pPz/g2zIq12uKrc
SyS32l7hHG99VA3YDXjNdcd9VKhbERQmo25fi/0qlTsNvmUpUtOaoA2r0RGBW0Jv
QNH5SSHw4lQnT4V7wLvdq18+HI8Fwo8Yx6UJMoLr8+UJP22HZJiF84Ro/SueI9oL
gDJFm+qBe5JiuzaboEVUDKfIuso4ZVMR1jfAd/ZCQndhxmTnoKjiA9zbFBaW3TMM
nOYXAGQ5IR6fRS6kAhEvlGLNXkMsny2almqljzXIRRjmWwm7IVvqjJNLjW9pQZhU
zXxVkYjZDpljQGzT202HkbfKZgDXwj5k81mcpTru9MootWbNWRyFI7dy0OhSWIKB
60D8gSpQKnCLYEZ+zkwcTIYh+K65GZLJgPXbywwMyGHtKTiVdvfIGrhRhDzPRR7B
u0bkV0SF1M26JBBoJtjyA6fNXjxXcnSOby66ZE2zS1qCE7BOuUY4Qx8fmvRa7BuF
V8o5a6rxGk1CxN3SyQl6bCWqPJysUB1uYyeDvN7vCbAArWDKGgHgypb+M+T228E0
INmxFbndetCq8zcYi2JTuw5BFO8/aNW7UCkcwky2HwriZUxMcTCCdaUnz2fv+Bvq
HQg2QozH2/qLAYiIjMNc
=a6t7
-----END PGP SIGNATURE-----

--UDq0p1ry40hcSP8u--