pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedLDAP auth
2+ messages / 2 participants
[nested] [flat]
* LDAP auth
@ 2019-06-19 11:36 Pierre Ochsenbein <pierreochsenbein@gmail.com>
0 siblings, 1 reply; 2+ messages in thread
From: Pierre Ochsenbein @ 2019-06-19 11:36 UTC (permalink / raw)
To: pgsql-admin
Hi
I'm running on PostgreSQL 10.6 and would like to connect with LDAP users
I have sync all users from my group in my database and I can find users :-)
hostssl all all 10.1.1.0/24 ldap
ldapurl="ldap://ldap.local/OU=ASA,OU=Forest%20Admin%20Accounts%20%26%20Roles,DC=ASATL,DC=NET?sAMAccountName?sub"
ldaptls=1 ldapbinddn="CN=POSTGRES,OU=Service Accounts,OU=Global,OU=Member
Servers,DC=PMINTL,DC=NET" ldapbindpasswd='password001'
What is the best way to put the LDAP query in pg_hba? I think the error
comes from here
Thanks
Pierre
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: LDAP auth
@ 2019-06-19 15:14 Stephen Frost <sfrost@snowman.net>
parent: Pierre Ochsenbein <pierreochsenbein@gmail.com>
0 siblings, 0 replies; 2+ messages in thread
From: Stephen Frost @ 2019-06-19 15:14 UTC (permalink / raw)
To: Pierre Ochsenbein <pierreochsenbein@gmail.com>; +Cc: pgsql-admin
Greetings,
* Pierre Ochsenbein (pierreochsenbein@gmail.com) wrote:
> I'm running on PostgreSQL 10.6 and would like to connect with LDAP users
> I have sync all users from my group in my database and I can find users :-)
>
> hostssl all all 10.1.1.0/24 ldap
> ldapurl="ldap://ldap.local/OU=ASA,OU=Forest%20Admin%20Accounts%20%26%20Roles,DC=ASATL,DC=NET?sAMAccountName?sub"
> ldaptls=1 ldapbinddn="CN=POSTGRES,OU=Service Accounts,OU=Global,OU=Member
> Servers,DC=PMINTL,DC=NET" ldapbindpasswd='password001'
>
> What is the best way to put the LDAP query in pg_hba? I think the error
> comes from here
Are you in an Active Directory environment? If so, you'd be much better
off using Kerberos/GSSAPI instead of LDAP. There's specific information
about doing that available here:
https://info.crunchydata.com/blog/windows-active-directory-postgresql-gssapi-kerberos-authentication
Note that when using LDAP in this way, the user's password ends up being
sent from the client to the server, so if the PG server is compromised
then user's passwords can end up being exposed, allowing a potential
attacker to then impersonate the user to gain access to other services
in the environment (as that's the user's single-sign-on password...).
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2019-06-19 15:14 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2019-06-19 11:36 LDAP auth Pierre Ochsenbein <pierreochsenbein@gmail.com>
2019-06-19 15:14 ` Stephen Frost <sfrost@snowman.net>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox