Date: Fri, 12 Jul 2019 08:18:48 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Pierre Ochsenbein <pierreochsenbein@gmail.com>
Cc: pgsql-admin <pgsql-admin@postgresql.org>
Subject: Re: PostgreSQL LDAP \ Kerberos
Message-ID: <20190712121848.GC29202@tamriel.snowman.net>
References: 
 <CABG8FoO=-Cy_UcVwZUfWJLs+HE=ZoeRzjYQUNLG8kBO1=B_rwg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="8imkiqSsqwBtMw7/"
Content-Disposition: inline
In-Reply-To: 
 <CABG8FoO=-Cy_UcVwZUfWJLs+HE=ZoeRzjYQUNLG8kBO1=B_rwg@mail.gmail.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--8imkiqSsqwBtMw7/
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Pierre Ochsenbein (pierreochsenbein@gmail.com) wrote:
> Somebody can give me Feedback about PostgreSQL Authentication with LDAP a=
nd
> Kerberos.

You should use Kerberos for authentication, using LDAP isn't a good idea
because the PG server will see the user's password.

> Actually I use LDAP authentication and I would like to test automatically
> authentication  with Kerberos...
>=20
> It's easy to implement and works fine, no bugs in perspective?

Yes, it works fine, just generate a keytab and copy it to somewhere that
the PG server can see it.  If you're in an active directory environment
then this requires a bit more than just an addprinc/ktadd, there's a
blog post I wrote about doing it here:

https://info.crunchydata.com/blog/windows-active-directory-postgresql-gssap=
i-kerberos-authentication

Thanks,

Stephen

--8imkiqSsqwBtMw7/
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJdKHqnAAoJEO1sijiDR2RVYNMP/1S481i5VvKvg+cL37M+XBvK
Zaehj7W2Pt2tV6pn1P7zrDk3eHGLhc+os1U4AMICM6vtXVStEqrlmIPP5v5TcAO3
ijkVMKxt7rScUHRzYDzKbhioJcaWYt7AKduPfLSS1ekzrc93aXAzJXpF5tsxPV6B
szDzHSc1qbc2GJqwKDAXAzN9c2om4B9vt2VxZNJqBn5w43LiwNTr7MPuTf/Gn6wr
FSshM0C2NZiP6H+ea2Veb33GJtFAiJgwf/8043nknkXYexRE5ImlwPn1mkevS+ld
7xD7uQYSrkTWmBua4/q9KxMlYC+R9U5IhzfX1dm8Fmmbf6coFR+xGjcOYvAwTR/F
7x1DW9tMyp4KfqZskX6P9xDisD5Tth9UG55PF92HbeWGVqC+NBuc90Fsq2c2vF7a
mAhRDtR608jHbnO/PxZLt7UQTtj1xUTgQy6fMXBF4ZQWn7GH5uhPz1yEkORBcqdl
pMSRwP/K/lKxeTHGU4TS8pAt/RXCxxvvJw+PqZUmSursh4BV0o82lfiGh3GKbW6P
Tz9Ee7Xi0eG2HHHLpN1XhbY4F1zKrqaXNkYdPqxs2cwNIAlnMc+N7gRDsZP4Gmm+
m9uk2BQt8w1NwaBjxRtTTV4WDMQO+UMIdVL8KacXuf2fUxLKqsHGTfWYJ7dXjatO
1amvcE7Bz45uM6/CV+Vq
=24NB
-----END PGP SIGNATURE-----

--8imkiqSsqwBtMw7/--