Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1gQe0Y-00020U-Tr for pgsql-admin@arkaria.postgresql.org; Sat, 24 Nov 2018 19:54:27 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1gQe0X-0004oH-Dh for pgsql-admin@arkaria.postgresql.org; Sat, 24 Nov 2018 19:54:25 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1gQe0X-0004oA-65 for pgsql-admin@lists.postgresql.org; Sat, 24 Nov 2018 19:54:25 +0000 Received: from mtaextp1.scidom.de ([146.107.103.20]) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1gQe0U-0000Sm-LK for pgsql-admin@lists.postgresql.org; Sat, 24 Nov 2018 19:54:24 +0000 Received: from localhost (localhost [127.0.0.1]) by mtaextp1.scidom.de (Postfix) with ESMTP id 1E37214E66D for ; Sat, 24 Nov 2018 20:54:21 +0100 (CET) Received: from mtaextp1.scidom.de ([127.0.0.1]) by localhost (mtaextp1.scidom.de [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id La7rSd9ftDT1 for ; Sat, 24 Nov 2018 20:54:20 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by mtaextp1.scidom.de (Postfix) with ESMTP id 709DD14E75E for ; Sat, 24 Nov 2018 20:54:20 +0100 (CET) X-Amavis-Modified: Mail body modified (using disclaimer) - mtaextp1.scidom.de X-Virus-Scanned: amavisd-new at mtaextp1.scidom.de Received: from mtaextp1.scidom.de ([127.0.0.1]) by localhost (mtaextp1.scidom.de [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id rXcvzukXIETB for ; Sat, 24 Nov 2018 20:54:20 +0100 (CET) Received: from mtaintp1.scidom.de (mtaintp1.scidom.de [146.107.8.104]) by mtaextp1.scidom.de (Postfix) with ESMTPS id 527BA14E66D for ; Sat, 24 Nov 2018 20:54:20 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by mtaintp1.scidom.de (Postfix) with ESMTP id 4B53A10239F for ; Sat, 24 Nov 2018 20:54:20 +0100 (CET) Received: from mtaintp1.scidom.de ([127.0.0.1]) by localhost (mtaintp1.scidom.de [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id Ye7CfeerX7A6 for ; Sat, 24 Nov 2018 20:54:19 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by mtaintp1.scidom.de (Postfix) with ESMTP id AF708102935 for ; Sat, 24 Nov 2018 20:54:19 +0100 (CET) X-Amavis-Modified: Mail body modified (using disclaimer) - mtaintp1.scidom.de X-Virus-Scanned: amavisd-new at mtaintp1.scidom.de Received: from mtaintp1.scidom.de ([127.0.0.1]) by localhost (mtaintp1.scidom.de [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id pXfvLzITn9RI for ; Sat, 24 Nov 2018 20:54:19 +0100 (CET) Received: from mbxp1.scidom.de (mbxp1.scidom.de [146.107.8.101]) by mtaintp1.scidom.de (Postfix) with ESMTP id 9233610239F for ; Sat, 24 Nov 2018 20:54:19 +0100 (CET) Date: Sat, 24 Nov 2018 20:54:19 +0100 (CET) From: "Lentes, Bernd" To: pgsql-admin Message-ID: <347994919.21311413.1543089259209.JavaMail.zimbra@helmholtz-muenchen.de> In-Reply-To: <20181123214423.GK3415@tamriel.snowman.net> References: <1819852155.20922807.1542983802608.JavaMail.zimbra@helmholtz-muenchen.de> <20181123151725.GH3415@tamriel.snowman.net> <448603474.21010176.1542999433914.JavaMail.zimbra@helmholtz-muenchen.de> <20181123191413.GJ3415@tamriel.snowman.net> <33999F41-3B4A-46D3-BB18-531CF8662C0E@helmholtz-muenchen.de> <20181123214423.GK3415@tamriel.snowman.net> Subject: Re: User Authentication: LDAP and "local" accounts concurrently ? MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Originating-IP: [146.107.3.103] X-Mailer: Zimbra 8.7.11_GA_2038 (ZimbraWebClient - GC70 (Win)/8.7.11_GA_1854) Thread-Topic: User Authentication: LDAP and "local" accounts concurrently ? Thread-Index: frAcKrVmmuWS9iLGAxb44ewO0ynmSg== List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk ----- Am 23. Nov 2018 um 22:44 schrieb Stephen Frost sfrost@snowman.net: > No, Kerberos/GSSAPI *never* transmits the user's password to the server. > The user's password is actually used as an encryption key and is known > only to the KDC (your domain controllers) and the user. The KDC and the > PG server then share a different encryption key (the service principal). > When the user wants to connect to PG they ask the KDC for a ticket which > the KDC returns to the user as a blob which contains some information > for the PG server encrypted with the PG server's key and then encrypts > that and sends it to the user, who then decrypts it and uses it to > connect to the PG server. > > How all of that works is a bit complicated but thankfully you don't > really need to worry about that- Windows and Active Directory handle > almost all of it. All you need to do is create a service principal in > active directory for the PG server and then export it and copy it over > to the PG server and then enable gssapi in PG. > > Thanks! > > Stephen Hi Stephen, thanks again for your answer. Does my client application (geneious, a bioinfromatic tool) have to support Kerberos in any way ? Bernd Helmholtz Zentrum Muenchen Deutsches Forschungszentrum fuer Gesundheit und Umwelt (GmbH) Ingolstaedter Landstr. 1 85764 Neuherberg www.helmholtz-muenchen.de Aufsichtsratsvorsitzende: MinDirig.in Petra Steiner-Hoffmann Stellv.Aufsichtsratsvorsitzender: MinDirig. Dr. Manfred Wolter Geschaeftsfuehrer: Prof. Dr. med. Dr. h.c. Matthias Tschoep, Heinrich Bassler, Dr. rer. nat. Alfons Enhsen Registergericht: Amtsgericht Muenchen HRB 6466 USt-IdNr: DE 129521671