Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jJdHH-000061-C9 for pgsql-admin@arkaria.postgresql.org; Wed, 01 Apr 2020 13:19:31 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1jJdHF-0006OA-BH for pgsql-admin@arkaria.postgresql.org; Wed, 01 Apr 2020 13:19:29 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jJdHF-0006O1-2t for pgsql-admin@lists.postgresql.org; Wed, 01 Apr 2020 13:19:29 +0000 Received: from tamriel.snowman.net ([2001:470:e38f::11]) by magus.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1jJdH4-0007kt-SA for pgsql-admin@postgresql.org; Wed, 01 Apr 2020 13:19:28 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 9D0015F7A0; Wed, 1 Apr 2020 09:19:17 -0400 (EDT) Date: Wed, 1 Apr 2020 09:19:17 -0400 From: Stephen Frost To: Anjul Tyagi Cc: pgsql-admin Subject: Re: LDAP Configuration Message-ID: <20200401131917.GV13712@tamriel.snowman.net> References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="hsoAP4Wa+/L9NF1J" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --hsoAP4Wa+/L9NF1J Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Greetings, * Anjul Tyagi (anjul@ibosstech-us.com) wrote: > we are implementing the LDAP authentication and we are able to connect with > LDAP and able to authenticate the user with that. However we have 2 type of > users, one - corporate users and available of Active Directory and second > application user, which is used by different application to connect with > database. In an Active Directory environment, you really should be using Kerberos (also known as GSSAPI) for authentication, using LDAP isn't secure as it means that the user's password will be sent to the PostgreSQL server. Thanks, Stephen --hsoAP4Wa+/L9NF1J Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJehJTVAAoJEO1sijiDR2RVAHkP/RCyTDSuiLeFlKqH4Nth6aJw 6n17QIyzzAAxOHmwad2NHKM1xXHK+Qi0e7VvffJcIm6jgKI62j0Jkkfll/Tdhu+P V5/7RVonjAEJsPFpRPn8TVleK/VWqn0noZPKvScQ38oQdCYfkcHM0B+QjcYPEEnB DQAayJmqOoL9aHB8uK0qIeAjsUDStFogBvQ8LMJh3O/t/Ic/BSkGGHLC6RHDbvzQ FdWij4o3BgCMX0PTrIFcO8U53IzXYbLTGoTg5HA57rx8wBnzY6KWmPXCF9mTeYfh esEJLekbEyj60UQ63YnCdC6xsAnO/dvJJn02wGSSyLbNY5ZS9YbUrFjaUWt4fGvt HCUlWK9LMTzGJwMY4s94Yjv6ZAMNmZ4Y12np6sEFoMiHBxL68eCrjeAGqfyKFGpv nS1HTH/yfCAQ6f/ulewcYGa/mizQj9WtFTQDyR9t2Lu5QPf0DsM9PCeTEqhR6TqW 2rKL0r0MngmWwn63nIoAEnlT3K7RzxiuSm8hq+7PcaJWyQFAcxj2nTVzi9GiXo40 v0xIspgrZPBcOTFjoNDJJUXa45VQPmxtqCuYEgUzRqOjZtHHbZSMfzeXM7UIT4Rx OW2nmZMUBaFSrFQX+IXagKs9fDAI0SYUjhZL18XrKVGeTMIUygXlw/6djMqF0laj ZSURQWrM4z8hkoMTgv81 =G23l -----END PGP SIGNATURE----- --hsoAP4Wa+/L9NF1J--