From: Lentes, Bernd <bernd.lentes@helmholtz-muenchen.de>
To: Stephen Frost <sfrost@snowman.net>
Cc: pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: User Authentication: LDAP and "local" accounts concurrently ?
Date: Fri, 23 Nov 2018 19:57:13 +0100 (CET)
Message-ID: <448603474.21010176.1542999433914.JavaMail.zimbra@helmholtz-muenchen.de> (raw)
In-Reply-To: <20181123151725.GH3415@tamriel.snowman.net>
References: <1819852155.20922807.1542983802608.JavaMail.zimbra@helmholtz-muenchen.de>
<20181123151725.GH3415@tamriel.snowman.net>
----- On Nov 23, 2018, at 4:17 PM, Stephen Frost sfrost@snowman.net wrote:
> Greetings,
>
> * Lentes, Bernd (bernd.lentes@helmholtz-muenchen.de) wrote:
>> i created a Postgres Server 9.6 on a SLES 12 SP3 box. In our institution we have
>> a Windows ADS which i like to use to authenticate users via LDAP.
>
> For running PostgreSQL in a Windows ADS environment, you should really
> be using GSSAPI / Kerberos and *not* using LDAP authentication.
>
> GSSAPI / Kerberos is what Windows uses to authenticate users and
> services and it's much more secure than using LDAP.
Hi Stephen,
thanks for your answer. I'm not familiar with LDAP, GSSAPI and Kerberos.
Why is it more secure ?
Bernd
Helmholtz Zentrum Muenchen
Deutsches Forschungszentrum fuer Gesundheit und Umwelt (GmbH)
Ingolstaedter Landstr. 1
85764 Neuherberg
www.helmholtz-muenchen.de
Aufsichtsratsvorsitzende: MinDirig.in Petra Steiner-Hoffmann
Stellv.Aufsichtsratsvorsitzender: MinDirig. Dr. Manfred Wolter
Geschaeftsfuehrer: Prof. Dr. med. Dr. h.c. Matthias Tschoep, Heinrich Bassler, Dr. rer. nat. Alfons Enhsen
Registergericht: Amtsgericht Muenchen HRB 6466
USt-IdNr: DE 129521671
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: bernd.lentes@helmholtz-muenchen.de, sfrost@snowman.net, pgsql-admin@lists.postgresql.org
Subject: Re: User Authentication: LDAP and "local" accounts concurrently ?
In-Reply-To: <448603474.21010176.1542999433914.JavaMail.zimbra@helmholtz-muenchen.de>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox