Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lk781-0001Si-28 for pgsql-admin@arkaria.postgresql.org; Fri, 21 May 2021 15:31:57 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1lk780-0003jI-0x for pgsql-admin@arkaria.postgresql.org; Fri, 21 May 2021 15:31:56 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lk77z-0003j9-Nl for pgsql-admin@lists.postgresql.org; Fri, 21 May 2021 15:31:55 +0000 Received: from tamriel.snowman.net ([2001:470:e38f::11]) by magus.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1lk77x-0003XV-Cr for pgsql-admin@lists.postgresql.org; Fri, 21 May 2021 15:31:55 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id ECF865F799; Fri, 21 May 2021 11:31:49 -0400 (EDT) Date: Fri, 21 May 2021 11:31:49 -0400 From: Stephen Frost To: Rocco Kreutz Cc: pgsql-admin@lists.postgresql.org Subject: Re: Secure LDAP auth on windows machine inside domain Message-ID: <20210521153149.GR20766@tamriel.snowman.net> References: <09ba8d97-6d81-2be9-0ada-7036c7d490df@prodat-sql.de> <44dd37ad-696a-f7a7-bf0a-ee59f08294c8@jakobs.com> <38c64d8a-1e64-59cb-0ef6-65da2abeb096@prodat-sql.de> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Fm/Pm8jaCtCefB2k" Content-Disposition: inline In-Reply-To: <38c64d8a-1e64-59cb-0ef6-65da2abeb096@prodat-sql.de> User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --Fm/Pm8jaCtCefB2k Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Greetings, * Rocco Kreutz (r.kreutz@prodat-sql.de) wrote: > It must be LDAP, because the users need to use a shortened diffrent login, > which is stored in ad You can map users using pg_ident.conf, there's no need to use LDAP to have a different login name in the database, and it's not secure to use LDAP. When LDAP is used, the user's credentials are seen by the server in the clear (and there's not really anything you can do about that, it's the nature of that auth method) and therefore if the DB server is compromised then everyone's credentials who logs into the DB server will also be compromised (TLS/SSL doesn't help because that only protects traffic across the network). Thanks, Stephen --Fm/Pm8jaCtCefB2k Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJgp9JlAAoJEO1sijiDR2RVZGsP/2grAM8OBXpEQHS6/s66jpVj KK1Uhik8jJAEekSGFuEZpXKsM4ZuzO+FeWKA5xDo4iXAQdHz/RxFFaKb31pMHLuV Pf1BS4pf/ebhpBoeZvH82uNsdUI8lJUnHv8CLmEmnv1fjVQiypPdzd7C+gi9Rnze UnG+n1D9C7gBAncEE15GPvXLCyL47/Hy13DQ+V9H0U1i2whLbz3/unX9MYZtcVMv fB1I8+wuZilZHunnQm/CuXBwo5YDaqZavK0g86CyvsnuxyZM0jWRpYXY4SJdH5lO FowdhejJiuZ4NCB4McOCC2VB/D+fbLFSSC3fYpikSN5gjUrQEuh9QF8yTudYw0C/ tdB8bDpbYMaxEtmohsh/Co9FKUEdqi5TaRRCpsK3BAh5kDmFDb5GRrwoO1ifeqhB rWbMbeC26H1Svo49M+FTBVPvyiyuQAQ8HX1Xx4AkIp5XbONxkwmvZj1q6E7O+vov S4o1vhdnWLL8MyaFuVe4yomYyH1R6xsxx7NsdDDt8W4B/0OJNIWBzxEOyvRT6hYC VghlrzFnD3l4jWWnsF62CBzrX3qSmJ7SdBF3fnc36H4aFT4wmXr08YBMATilGYN1 KnhK+1dWyqMnpMqjtskixfm+bul7+PxpPRDtSiPZhdB1R99K5PuajIKyi4D51NuI TjUB13BkEzoKRdLTynmg =CQyJ -----END PGP SIGNATURE----- --Fm/Pm8jaCtCefB2k--