pg.ddx.io  pgsql-admin@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Lentes, Bernd <bernd.lentes@helmholtz-muenchen.de>
To: pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: User Authentication: LDAP and "local" accounts concurrently ?
Date: Sat, 24 Nov 2018 20:54:19 +0100 (CET)
Message-ID: <347994919.21311413.1543089259209.JavaMail.zimbra@helmholtz-muenchen.de> (raw)
In-Reply-To: <20181123214423.GK3415@tamriel.snowman.net>
References: <1819852155.20922807.1542983802608.JavaMail.zimbra@helmholtz-muenchen.de>
	<20181123151725.GH3415@tamriel.snowman.net>
	<448603474.21010176.1542999433914.JavaMail.zimbra@helmholtz-muenchen.de>
	<20181123191413.GJ3415@tamriel.snowman.net>
	<33999F41-3B4A-46D3-BB18-531CF8662C0E@helmholtz-muenchen.de>
	<20181123214423.GK3415@tamriel.snowman.net>


----- Am 23. Nov 2018 um 22:44 schrieb Stephen Frost sfrost@snowman.net:

> No, Kerberos/GSSAPI *never* transmits the user's password to the server.
> The user's password is actually used as an encryption key and is known
> only to the KDC (your domain controllers) and the user.  The KDC and the
> PG server then share a different encryption key (the service principal).
> When the user wants to connect to PG they ask the KDC for a ticket which
> the KDC returns to the user as a blob which contains some information
> for the PG server encrypted with the PG server's key and then encrypts
> that and sends it to the user, who then decrypts it and uses it to
> connect to the PG server.
> 
> How all of that works is a bit complicated but thankfully you don't
> really need to worry about that- Windows and Active Directory handle
> almost all of it.  All you need to do is create a service principal in
> active directory for the PG server and then export it and copy it over
> to the PG server and then enable gssapi in PG.
> 
> Thanks!
> 
> Stephen

Hi Stephen,

thanks again for your answer. Does my client application (geneious, a bioinfromatic tool)
have to support Kerberos in any way ?

Bernd
 

Helmholtz Zentrum Muenchen
Deutsches Forschungszentrum fuer Gesundheit und Umwelt (GmbH)
Ingolstaedter Landstr. 1
85764 Neuherberg
www.helmholtz-muenchen.de
Aufsichtsratsvorsitzende: MinDirig.in Petra Steiner-Hoffmann
Stellv.Aufsichtsratsvorsitzender: MinDirig. Dr. Manfred Wolter
Geschaeftsfuehrer: Prof. Dr. med. Dr. h.c. Matthias Tschoep, Heinrich Bassler, Dr. rer. nat. Alfons Enhsen
Registergericht: Amtsgericht Muenchen HRB 6466
USt-IdNr: DE 129521671





view thread (12+ messages)  latest in thread

Message-ID: <347994919.21311413.1543089259209.JavaMail.zimbra@helmholtz-muenchen.de>
Permalink:  ../347994919.21311413.1543089259209.JavaMail.zimbra@helmholtz-muenchen.de/
Also on:    postgresql.org/message-id/347994919.21311413.1543089259209.JavaMail.zimbra@helmholtz-muenchen.de

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-admin@postgresql.org
  Cc: bernd.lentes@helmholtz-muenchen.de, pgsql-admin@lists.postgresql.org
  Subject: Re: User Authentication: LDAP and "local" accounts concurrently ?
  In-Reply-To: <347994919.21311413.1543089259209.JavaMail.zimbra@helmholtz-muenchen.de>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox