Subject: Re: Secure LDAP auth on windows machine inside domain
To: pgsql-admin@lists.postgresql.org
References: <09ba8d97-6d81-2be9-0ada-7036c7d490df@prodat-sql.de>
From: Holger Jakobs <holger@jakobs.com>
Message-ID: <44dd37ad-696a-f7a7-bf0a-ee59f08294c8@jakobs.com>
Date: Fri, 21 May 2021 14:45:16 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.10.2
MIME-Version: 1.0
In-Reply-To: <09ba8d97-6d81-2be9-0ada-7036c7d490df@prodat-sql.de>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="2Be1EfwjDdi8DLq3444XUKBBjmuLCS5lT"
Archived-At: 
 <https://www.postgresql.org/message-id/44dd37ad-696a-f7a7-bf0a-ee59f08294c8%40jakobs.com>
Precedence: bulk

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--2Be1EfwjDdi8DLq3444XUKBBjmuLCS5lT
Content-Type: multipart/mixed; boundary="3WERNmyJog7kAUQQfWmVgt5HyK3feylzK";
 protected-headers="v1"
From: Holger Jakobs <holger@jakobs.com>
To: pgsql-admin@lists.postgresql.org
Message-ID: <44dd37ad-696a-f7a7-bf0a-ee59f08294c8@jakobs.com>
Subject: Re: Secure LDAP auth on windows machine inside domain
References: <09ba8d97-6d81-2be9-0ada-7036c7d490df@prodat-sql.de>
In-Reply-To: <09ba8d97-6d81-2be9-0ada-7036c7d490df@prodat-sql.de>

--3WERNmyJog7kAUQQfWmVgt5HyK3feylzK
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Language: de-DE

Am 21.05.21 um 14:02 schrieb Rocco Kreutz:
> I'm looking for some help with setting up LDAP-Auth.
>
> Scenaria is:
> - Computer in Windows Domain runs postgreSQL
> - The AD-DC is using a self-signed certificate
> - That cert is already imported to trusted root cert store on that=20
> computer
> - LDAP auth without encryption does work fine
> =C2=A0 (
> =C2=A0 ldap ldapserver=3D???.???.???.de ldaptls=3D0=20
> ldapbasedn=3D"CN=3DUsers,DC=3D???,DC=3D???,DC=3D???"=20
> ldapbinddn=3D"CN=3Dprodatbind,CN=3DUsers,DC=3D???,DC=3D???,DC=3D???"=20
> ldapbindpasswd=3D"???" ldapsearchattribute=3D"sAMAccountName"
> =C2=A0 )
> - i'm trying to logon as prodatadmin (prodatbind account is just for=20
> the ldap-bind)
> - Now either tls or ldaps needs to be activated
>
>
>
> If i change to tls=3D1 i get the errormessage:
>
> 2021-05-21 13:38:35.639 CEST [968] LOG:=C2=A0 could not start LDAP TLS =

> session: Lokaler Fehler
> 2021-05-21 13:38:35.639 CEST [968] DETAIL:=C2=A0 LDAP diagnostics: Loka=
ler=20
> Fehler
> 2021-05-21 13:38:35.640 CEST [968] FATAL:=C2=A0 LDAP authentication fai=
led=20
> for user "prodatadmin"
>
> Lokaler Fehler -> local error
>
>
> if i change to ldaps i get the errormessage:
>
> 2021-05-21 13:41:34.759 CEST [13412] LOG:=C2=A0 could not perform initi=
al=20
> LDAP bind for ldapbinddn "CN=3Dprodatbind,CN=3DUsers,DC=3D???,DC=3D???,=
DC=3D???"=20
> on server "???.???.???.???": Server heruntergefahren
> 2021-05-21 13:41:34.759 CEST [13412] DETAIL:=C2=A0 LDAP diagnostics: Se=
rver=20
> heruntergefahren
> 2021-05-21 13:41:34.760 CEST [13412] FATAL:=C2=A0 LDAP authentication=20
> failed for user "prodatadmin"
>
> Server heruntergefahren -> Server is down
>
>
> with ldapadmin (ldapadmin.org) i can connect with ssl or tls. I just=20
> get a warning about the certificate.
> So what do i need to do, to get postgrSQL LDAP to accept that=20
> certificate?
>
> Thx
>
>
> If both your clients and server are running on Windows, the best=20
> authentication method is SSPI.
>
--=20
Holger Jakobs, Bergisch Gladbach, Tel. +49-178-9759012


--3WERNmyJog7kAUQQfWmVgt5HyK3feylzK--

--2Be1EfwjDdi8DLq3444XUKBBjmuLCS5lT
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

wmMEABEIACMWIQScuJCxWJK1p5BOebGKV5yTsxlhugUCYKerXQUDAAAAAAAKCRCKV5yTsxlhuiYp
AKClujmQL0QNK2dx+ep0s57Jzjh+bACg1CNPSh38sUq6vPCfvjBSdEFM8Ec=
=TLZt
-----END PGP SIGNATURE-----

--2Be1EfwjDdi8DLq3444XUKBBjmuLCS5lT--