From: Stephen Frost <sfrost@snowman.net>
To: Pierre Ochsenbein <pierreochsenbein@gmail.com>
Cc: pgsql-admin <pgsql-admin@postgresql.org>
Subject: Re: PostgreSQL LDAP \ Kerberos
Date: Fri, 12 Jul 2019 08:18:48 -0400
Message-ID: <20190712121848.GC29202@tamriel.snowman.net> (raw)
In-Reply-To: <CABG8FoO=-Cy_UcVwZUfWJLs+HE=ZoeRzjYQUNLG8kBO1=B_rwg@mail.gmail.com>
References: <CABG8FoO=-Cy_UcVwZUfWJLs+HE=ZoeRzjYQUNLG8kBO1=B_rwg@mail.gmail.com>
Greetings,
* Pierre Ochsenbein (pierreochsenbein@gmail.com) wrote:
> Somebody can give me Feedback about PostgreSQL Authentication with LDAP and
> Kerberos.
You should use Kerberos for authentication, using LDAP isn't a good idea
because the PG server will see the user's password.
> Actually I use LDAP authentication and I would like to test automatically
> authentication with Kerberos...
>
> It's easy to implement and works fine, no bugs in perspective?
Yes, it works fine, just generate a keytab and copy it to somewhere that
the PG server can see it. If you're in an active directory environment
then this requires a bit more than just an addprinc/ktadd, there's a
blog post I wrote about doing it here:
https://info.crunchydata.com/blog/windows-active-directory-postgresql-gssapi-kerberos-authentication
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, pierreochsenbein@gmail.com
Subject: Re: PostgreSQL LDAP \ Kerberos
In-Reply-To: <20190712121848.GC29202@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox