From: Stephen Frost <sfrost@snowman.net>
To: Pierre Ochsenbein <pierreochsenbein@gmail.com>
Cc: pgsql-admin <pgsql-admin@postgresql.org>
Subject: Re: LDAP auth
Date: Wed, 19 Jun 2019 11:14:50 -0400
Message-ID: <20190619151450.GS2480@tamriel.snowman.net> (raw)
In-Reply-To: <CABG8FoMqBzOWBASWThxPnsu+yuhwR1mSUr+3BXoQKHH5gN27aA@mail.gmail.com>
References: <CABG8FoMqBzOWBASWThxPnsu+yuhwR1mSUr+3BXoQKHH5gN27aA@mail.gmail.com>
Greetings,
* Pierre Ochsenbein (pierreochsenbein@gmail.com) wrote:
> I'm running on PostgreSQL 10.6 and would like to connect with LDAP users
> I have sync all users from my group in my database and I can find users :-)
>
> hostssl all all 10.1.1.0/24 ldap
> ldapurl="ldap://ldap.local/OU=ASA,OU=Forest%20Admin%20Accounts%20%26%20Roles,DC=ASATL,DC=NET?sAMAccountName?sub"
> ldaptls=1 ldapbinddn="CN=POSTGRES,OU=Service Accounts,OU=Global,OU=Member
> Servers,DC=PMINTL,DC=NET" ldapbindpasswd='password001'
>
> What is the best way to put the LDAP query in pg_hba? I think the error
> comes from here
Are you in an Active Directory environment? If so, you'd be much better
off using Kerberos/GSSAPI instead of LDAP. There's specific information
about doing that available here:
https://info.crunchydata.com/blog/windows-active-directory-postgresql-gssapi-kerberos-authentication
Note that when using LDAP in this way, the user's password ends up being
sent from the client to the server, so if the PG server is compromised
then user's passwords can end up being exposed, allowing a potential
attacker to then impersonate the user to gain access to other services
in the environment (as that's the user's single-sign-on password...).
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, pierreochsenbein@gmail.com
Subject: Re: LDAP auth
In-Reply-To: <20190619151450.GS2480@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox