pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedLDAP configuration
5+ messages / 4 participants
[nested] [flat]
* LDAP configuration
@ 2011-08-09 07:24 Venkat Balaji <venkat.balaji@verse.in>
0 siblings, 0 replies; 5+ messages in thread
From: Venkat Balaji @ 2011-08-09 07:24 UTC (permalink / raw)
To: pgsql-admin
Hello,
I need help on configuring LDAP for PostgreSQL 9.0.1.
The Postgres cluster should allow only LDAP connections from remote clients.
I have PG-9.0.1 built with LDAP option.
Please help !
Thanks
Nag
^ permalink raw reply [nested|flat] 5+ messages in thread
* LDAP Configuration
@ 2020-04-01 10:29 Anjul Tyagi <anjul@ibosstech-us.com>
2020-04-01 11:33 ` Re: LDAP Configuration Laurenz Albe <laurenz.albe@cybertec.at>
2020-04-01 13:19 ` Re: LDAP Configuration Stephen Frost <sfrost@snowman.net>
0 siblings, 2 replies; 5+ messages in thread
From: Anjul Tyagi @ 2020-04-01 10:29 UTC (permalink / raw)
To: pgsql-admin
Team,
we are implementing the LDAP authentication and we are able to connect
with LDAP and able to authenticate the user with that. However we have 2
type of users, one - corporate users and available of Active Directory
and second application user, which is used by different application to
connect with database.
Below entry i did in the pg_hba.conf file, if i create user in DB
(similar exist on AD) it works. However if i create one user with
password, it calls the LDAP server for authentication and fails as it
does not exists in AD.
host all all 0.0.0.0/0 ldap
ldapserver=<LDAL Server> ldapbasedn="OU=Corporate,DC=etch,dc=com"
ldapbinddn="CN=AdSyncAcct,OU=Service Accounts,DC=etch,DC=com"
ldapbindpasswd="Password" ldapsearchattribute="sAMAccountName"
we are using the postgres 10.10 version.
can you please suggest the pg_hba.conf file entry, that will help us to
authenticate the users from LDAP and from postgres as well.
Regards,
Anjul TYAGI
ü Go Green
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: LDAP Configuration
2020-04-01 10:29 LDAP Configuration Anjul Tyagi <anjul@ibosstech-us.com>
@ 2020-04-01 11:33 ` Laurenz Albe <laurenz.albe@cybertec.at>
2020-04-01 11:49 ` Re: LDAP Configuration Anjul Tyagi <anjul@ibosstech-us.com>
1 sibling, 1 reply; 5+ messages in thread
From: Laurenz Albe @ 2020-04-01 11:33 UTC (permalink / raw)
To: Anjul Tyagi <anjul@ibosstech-us.com>; pgsql-admin
On Wed, 2020-04-01 at 10:29 +0000, Anjul Tyagi wrote:
> we are implementing the LDAP authentication and we are able to connect with LDAP and able to
> authenticate the user with that. However we have 2 type of users, one - corporate users and
> available of Active Directory and second application user, which is used by different
> application to connect with database.
>
> Below entry i did in the pg_hba.conf file, if i create user in DB (similar exist on AD) it works.
> However if i create one user with password, it calls the LDAP server for authentication
> and fails as it does not exists in AD.
>
> host all all 0.0.0.0/0 ldap ldapserver=<LDAL Server> ldapbasedn="OU=Corporate,DC=etch,dc=com" ldapbinddn="CN=AdSyncAcct,OU=Service Accounts,DC=etch,DC=com"
> ldapbindpasswd="Password" ldapsearchattribute="sAMAccountName"
>
> we are using the postgres 10.10 version.
>
> can you please suggest the pg_hba.conf file entry, that will help us to authenticate the users
> from LDAP and from postgres as well.
Create a NOLOGIN role "ldapusers" in PostgreSQL and assign the users to authenticate
with LDAP to that group.
Then use two lines in pg_hba.conf:
host all +ldapusers 0.0.0.0/0 ldap ...
host all all 0.0.0.0/0 scram-sha-256
All users in the "ldapusers" group will be authenticated with LDAP,
and the others will "fall through" to the password authentication.
Yours,
Laurenz Albe
--
Cybertec | https://www.cybertec-postgresql.com
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: LDAP Configuration
2020-04-01 10:29 LDAP Configuration Anjul Tyagi <anjul@ibosstech-us.com>
2020-04-01 11:33 ` Re: LDAP Configuration Laurenz Albe <laurenz.albe@cybertec.at>
@ 2020-04-01 11:49 ` Anjul Tyagi <anjul@ibosstech-us.com>
0 siblings, 0 replies; 5+ messages in thread
From: Anjul Tyagi @ 2020-04-01 11:49 UTC (permalink / raw)
To: Laurenz Albe <laurenz.albe@cybertec.at>; pgsql-admin
Thanks Laurenz Albe!!!
I did the same and it worked for me...
Regards,
Anjul TYAGI
ü Go Green
------ Original Message ------
From: "Laurenz Albe" <laurenz.albe@cybertec.at>
To: "Anjul Tyagi" <anjul@ibosstech-us.com>; "pgsql-admin"
<pgsql-admin@postgresql.org>
Sent: 4/1/2020 5:03:04 PM
Subject: Re: LDAP Configuration
>On Wed, 2020-04-01 at 10:29 +0000, Anjul Tyagi wrote:
>> we are implementing the LDAP authentication and we are able to connect with LDAP and able to
>> authenticate the user with that. However we have 2 type of users, one - corporate users and
>> available of Active Directory and second application user, which is used by different
>> application to connect with database.
>>
>> Below entry i did in the pg_hba.conf file, if i create user in DB (similar exist on AD) it works.
>> However if i create one user with password, it calls the LDAP server for authentication
>> and fails as it does not exists in AD.
>>
>> host all all 0.0.0.0/0 ldap ldapserver=<LDAL Server> ldapbasedn="OU=Corporate,DC=etch,dc=com" ldapbinddn="CN=AdSyncAcct,OU=Service Accounts,DC=etch,DC=com"
>> ldapbindpasswd="Password" ldapsearchattribute="sAMAccountName"
>>
>> we are using the postgres 10.10 version.
>>
>> can you please suggest the pg_hba.conf file entry, that will help us to authenticate the users
>> from LDAP and from postgres as well.
>
>Create a NOLOGIN role "ldapusers" in PostgreSQL and assign the users to authenticate
>with LDAP to that group.
>
>Then use two lines in pg_hba.conf:
>
>host all +ldapusers 0.0.0.0/0 ldap ...
>host all all 0.0.0.0/0 scram-sha-256
>
>All users in the "ldapusers" group will be authenticated with LDAP,
>and the others will "fall through" to the password authentication.
>
>Yours,
>Laurenz Albe
>--
>Cybertec | https://www.cybertec-postgresql.com
>
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: LDAP Configuration
2020-04-01 10:29 LDAP Configuration Anjul Tyagi <anjul@ibosstech-us.com>
@ 2020-04-01 13:19 ` Stephen Frost <sfrost@snowman.net>
1 sibling, 0 replies; 5+ messages in thread
From: Stephen Frost @ 2020-04-01 13:19 UTC (permalink / raw)
To: Anjul Tyagi <anjul@ibosstech-us.com>; +Cc: pgsql-admin
Greetings,
* Anjul Tyagi (anjul@ibosstech-us.com) wrote:
> we are implementing the LDAP authentication and we are able to connect with
> LDAP and able to authenticate the user with that. However we have 2 type of
> users, one - corporate users and available of Active Directory and second
> application user, which is used by different application to connect with
> database.
In an Active Directory environment, you really should be using Kerberos
(also known as GSSAPI) for authentication, using LDAP isn't secure as it
means that the user's password will be sent to the PostgreSQL server.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2020-04-01 13:19 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2011-08-09 07:24 LDAP configuration Venkat Balaji <venkat.balaji@verse.in>
2020-04-01 10:29 LDAP Configuration Anjul Tyagi <anjul@ibosstech-us.com>
2020-04-01 11:33 ` Re: LDAP Configuration Laurenz Albe <laurenz.albe@cybertec.at>
2020-04-01 11:49 ` Re: LDAP Configuration Anjul Tyagi <anjul@ibosstech-us.com>
2020-04-01 13:19 ` Re: LDAP Configuration Stephen Frost <sfrost@snowman.net>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox