Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kn2Mk-0006gR-J8 for pgsql-admin@arkaria.postgresql.org; Wed, 09 Dec 2020 16:30:58 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kn2Mj-0008NY-Hb for pgsql-admin@arkaria.postgresql.org; Wed, 09 Dec 2020 16:30:57 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kn2Mj-0008NR-AD for pgsql-admin@lists.postgresql.org; Wed, 09 Dec 2020 16:30:57 +0000 Received: from tamriel.snowman.net ([2001:470:e38f::11]) by makus.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kn2Me-0003bw-BI for pgsql-admin@lists.postgresql.org; Wed, 09 Dec 2020 16:30:56 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 67EE95F799; Wed, 9 Dec 2020 11:30:50 -0500 (EST) Date: Wed, 9 Dec 2020 11:30:50 -0500 From: Stephen Frost To: Ron Cc: Pgsql-admin Subject: Re: LDAP and roles Message-ID: <20201209163050.GW16415@tamriel.snowman.net> References: <487c76f4-185c-b712-2d22-a6e6e9b86c6b@gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="uD6npnv77eu8CZO/" Content-Disposition: inline In-Reply-To: <487c76f4-185c-b712-2d22-a6e6e9b86c6b@gmail.com> User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --uD6npnv77eu8CZO/ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Greetings, * Ron (ronljohnsonjr@gmail.com) wrote: > Does LDAP obviate the need for the PASSWORD clause of CREATE ROLE? It sounds > obvious, but I wanted to verify before deciding whether or not to try LDAP, > and did not see any reference in > https://www.postgresql.org/docs/12/sql-createrole.html. Using GSSAPI also results in the password not being needed to be set for the role, and is actually secure, unlike LDAP-based auth where the user's password is happily sent in the clear to the PG server. Thanks, Stephen --uD6npnv77eu8CZO/ Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJf0Pu5AAoJEO1sijiDR2RV1ioP/RuVer3cPJFEpP8Tn/BfpO/I 352FZWWsfMbVpAb6IGFDFC6pGlpfjLOi7RbJLEAjQtcicXPIYlAhGqr1P7THo4zE 8q4AbCkOjxYmSiFUpOYJm/DE0H5/VIvVywkJ3zsFqYUfztn0HJbRQHVEKTmKlsIz 0uEj/DRqviJHMyFATc9z/wZI0aoj1PjNdPNjVLbNc+JWPnswLw/jYExGev/5HC8C e+SwfECMK6cWFhAdbz7TrjS+nfCy97PLxnTwNXBxFk8BZh8gV5mUv8oq44mDIfyJ Etk1PMDtKdg9hj8R3K4aJEi13mFgsGOtmooHwTlp5W0sV9BqgwkcOgHb+4o7fbF8 oiSBrcU3TgMxgUiAT21t+izAZGRyXrGI3J1FIyRZ1jSoZ22c9D9xOM3ohlBDHR+K QI5v/s32w17ExDjH2FCjpr0kPXoCTfOW/Pu8dmz2+F2d69WjgVcXSRTlKOY/GDw3 fPhZ5kd2g+Ipss0kXVVfUcnpim5eUiQuyGrS5HjhmnRFVGiR6XEDenJDcQDcQgMr N4KnaGH7Q+/Tr3oiK+g+UWoUcACFzVxtMWfHzENcRyw2uQpqh84gN1rzdc8HNOI3 uhcbpDGKk6ExEHDkffbbiM44ifb86lzsPCIoXwaBj9fAWIZNJxXsF2WJ5iAvLKit dJBLg9OhgaNZUcNyN3MV =1q/6 -----END PGP SIGNATURE----- --uD6npnv77eu8CZO/--