Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1nAzvJ-0000DB-7d for pgsql-admin@arkaria.postgresql.org; Fri, 21 Jan 2022 19:50:13 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1nAzvI-0000jB-19 for pgsql-admin@arkaria.postgresql.org; Fri, 21 Jan 2022 19:50:12 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1nAzvH-0000fc-MQ for pgsql-admin@lists.postgresql.org; Fri, 21 Jan 2022 19:50:11 +0000 Received: from tamriel.snowman.net ([70.109.60.50]) by magus.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1nAzvE-0004Rz-Ft for pgsql-admin@lists.postgresql.org; Fri, 21 Jan 2022 19:50:10 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id E58D25F79F; Fri, 21 Jan 2022 14:50:07 -0500 (EST) Date: Fri, 21 Jan 2022 14:50:07 -0500 From: Stephen Frost To: Daulat Cc: pgsql-admin Subject: Re: Password authorization Message-ID: <20220121195007.GI10577@tamriel.snowman.net> References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="yzvKDKJiLNESc64M" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --yzvKDKJiLNESc64M Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Greetings, * Daulat (daulat.dba@gmail.com) wrote: > Is there any alternative in postgres to manage the user password > authorisation? > What about LDAP with respect to this approach? PostgreSQL supports GSSAPI / Kerberos, which is a much better approach in Active Directory and other environments where Kerberos is deployed. Using LDAP exposes the user's password to the database server and therefore isn't secure and should be strongly discouraged. You can certainly have applications authenticate to PostgreSQL using Kerberos too with very little overhead (unlike PG's LDAP authentication option, which makes a synchronous call out to the LDAP server on each and every login). Thanks, Stephen --yzvKDKJiLNESc64M Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJh6w5vAAoJEO1sijiDR2RVMnYP/A4/Rz75Xdd6OoWFp1nruFnh F+fcQO1MePIHqC3KAbLh3EIE0y2e02lBf9ELk4OWXNA6tE7hmOTSZeHrnSVM0FX8 IgSw3NU7X28rNW+8h1238ORRi1gD4H8SNb15HgHcw88higTpPD8DwcNjX+jdkJ73 1BHZOEHGdPKoJu2DHBbN8IPO65o3fsRbkV+5imVDcJd7kDY+j7rfyZKtmhDnNe5+ TxkUOvnGFcu9cRKXHcSBebmlkJBVs1cXNlttJ+HOVfGIy3uHb3tN2DyrvtV4D2oj N8slN/cufnh343cA2mtG0+JTD9u2vZwdadBWsGcIMRU9i7j/itdJbo4tc60yQWki 16yM4Ksd37hq1miXnSQ7gRg32ewHKJ48zv1bP8QZyfl8t+aT83LUenMYilDb2RMs x+znVgAEGaobZpEJpMX//pNzE++8LzgUys6KhNSapVu6/o33v0ZlRHYu9KAgFowg jkfDmbZ9x+/ebhLIMjSqu/eqXiSek3W+Zgr+34UP1MmJBsSWHPNjYlOrtlTB4Fsn 6Z3mQnxtPEeT12u9tLCgMXa1EYWfwDlFG1KWVCoI8SwG7ps2j30rnrBXKAsxLJg2 GR8jgHkELVXViirZR9WBdq9g8ofVUVqW0j/MxB595QbERR7hT/CNP1RIF/0Kuasm 0wtbbw3klrN9J6jqWvTR =bMDL -----END PGP SIGNATURE----- --yzvKDKJiLNESc64M--