Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hdcIZ-0003OI-K1 for pgsql-admin@arkaria.postgresql.org; Wed, 19 Jun 2019 15:14:55 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1hdcIY-0006aW-Ai for pgsql-admin@arkaria.postgresql.org; Wed, 19 Jun 2019 15:14:54 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hdcIX-0006Xu-SI for pgsql-admin@lists.postgresql.org; Wed, 19 Jun 2019 15:14:54 +0000 Received: from tamriel.snowman.net ([2001:470:e38f::11]) by makus.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1hdcIV-0004Ki-7S for pgsql-admin@postgresql.org; Wed, 19 Jun 2019 15:14:52 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id C59BD5F7A7; Wed, 19 Jun 2019 11:14:50 -0400 (EDT) Date: Wed, 19 Jun 2019 11:14:50 -0400 From: Stephen Frost To: Pierre Ochsenbein Cc: pgsql-admin Subject: Re: LDAP auth Message-ID: <20190619151450.GS2480@tamriel.snowman.net> References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="zBkzUKoNN9/BHFeb" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --zBkzUKoNN9/BHFeb Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Greetings, * Pierre Ochsenbein (pierreochsenbein@gmail.com) wrote: > I'm running on PostgreSQL 10.6 and would like to connect with LDAP users > I have sync all users from my group in my database and I can find users := -) >=20 > hostssl all all 10.1.1.0/24 ldap > ldapurl=3D"ldap://ldap.local/OU=3DASA,OU=3DForest%20Admin%20Accounts%20%2= 6%20Roles,DC=3DASATL,DC=3DNET?sAMAccountName?sub" > ldaptls=3D1 ldapbinddn=3D"CN=3DPOSTGRES,OU=3DService Accounts,OU=3DGlobal= ,OU=3DMember > Servers,DC=3DPMINTL,DC=3DNET" ldapbindpasswd=3D'password001' >=20 > What is the best way to put the LDAP query in pg_hba? I think the error > comes from here Are you in an Active Directory environment? If so, you'd be much better off using Kerberos/GSSAPI instead of LDAP. There's specific information about doing that available here: https://info.crunchydata.com/blog/windows-active-directory-postgresql-gssap= i-kerberos-authentication Note that when using LDAP in this way, the user's password ends up being sent from the client to the server, so if the PG server is compromised then user's passwords can end up being exposed, allowing a potential attacker to then impersonate the user to gain access to other services in the environment (as that's the user's single-sign-on password...). Thanks, Stephen --zBkzUKoNN9/BHFeb Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJdClFqAAoJEO1sijiDR2RVWVYQAKuJMlYrC+TS8oSBsH3gbbpD EgYoOpREoBuN3iR7zGuRP1hyNuJcMs35kmP5paeGWclRf8tCYDMKo6GvBGv7ocHZ bHOmgWchoT2iNz6zOiL+Sr0DgOJxIGwKljrFUrbrBqa75r0rLQTmRB+MDIcfJyvL Yz14B9qx2IS8fecnQDv7dhax4ptr8AkKYjydsHpDeEHsNB2+pY8R3MpnqSEt+PmX Q6azrzLQKJ/a9iZGvOwGL4Ri3KldVwJTGhVWyXetEWhAqlryTBncs97z5wxpgHBN S8LN7MbHeZQRE0EOXA8pV/NqybEKE3MKJbtsdYzJcispK5XyTTwlQvmJpIgMxgvU QNJWMMY/si+llF5byaee4qbqDkEZzF7uwy3PWWbWly3WYXt+UpULjUEw50VaH8Fz bVEExYpYd2gAAgR/JKTsUabkDbX8i9vXr4GQ7e8nU3WdTFSRHZHdlgJN90dt5S7S qL7zbZOrzcw2m5wgC2zgO/CjJr/9oJOyO+sqmimTVJpAtgotIFd068CUYETcUdFZ azvMmvZl+7iXZBhVn7NfyQc+L0s6x4DdpodwAVZkb0eEhkcso+ZRs1DqQ2kY0hF0 qqkMT3kpVZyb7qy9XGdwmyJ5SrMfjt4lMlAyIvl91n6t08zpagfAz4hmEUXyQeIC LoqG9UeYDjUbbixydS9m =fAo3 -----END PGP SIGNATURE----- --zBkzUKoNN9/BHFeb--