From: Stephen Frost <sfrost@snowman.net>
To: Rocco Kreutz <r.kreutz@prodat-sql.de>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: Secure LDAP auth on windows machine inside domain
Date: Fri, 21 May 2021 11:31:49 -0400
Message-ID: <20210521153149.GR20766@tamriel.snowman.net> (raw)
In-Reply-To: <38c64d8a-1e64-59cb-0ef6-65da2abeb096@prodat-sql.de>
References: <09ba8d97-6d81-2be9-0ada-7036c7d490df@prodat-sql.de>
<44dd37ad-696a-f7a7-bf0a-ee59f08294c8@jakobs.com>
<38c64d8a-1e64-59cb-0ef6-65da2abeb096@prodat-sql.de>
Greetings,
* Rocco Kreutz (r.kreutz@prodat-sql.de) wrote:
> It must be LDAP, because the users need to use a shortened diffrent login,
> which is stored in ad
You can map users using pg_ident.conf, there's no need to use LDAP to
have a different login name in the database, and it's not secure to use
LDAP.
When LDAP is used, the user's credentials are seen by the server in the
clear (and there's not really anything you can do about that, it's the
nature of that auth method) and therefore if the DB server is
compromised then everyone's credentials who logs into the DB server will
also be compromised (TLS/SSL doesn't help because that only protects
traffic across the network).
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, r.kreutz@prodat-sql.de, pgsql-admin@lists.postgresql.org
Subject: Re: Secure LDAP auth on windows machine inside domain
In-Reply-To: <20210521153149.GR20766@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox