DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=QapHtSJ077+xKvQgkvCd/ITmFvGqKAe0snEa2BV4CeL98WJMHR5BIBrIR/wP5OPQhHTBy7sEPbRVgILhPwVm1M3n5w3Y8gRcGAjr6JrZ3nWYaAf4T0me9sq3XCj+i+p4/C47AEpf6sOUyBs+5OHw+DP13AWBajzq4aOXAvoz5vE=
Message-ID: <4544e0330804181043y6db18a9bve072aa5bc44a8cc4@mail.gmail.com>
Date: Fri, 18 Apr 2008 12:43:20 -0500
From: "Peter Koczan" <pjkoczan@gmail.com>
To: "pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
Subject: Re: PG 8.3 and kerberos failures
In-Reply-To: <4544e0330804170940j45035b17s42071d7b2358ae80@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <4544e0330804170940j45035b17s42071d7b2358ae80@mail.gmail.com>

On Thu, Apr 17, 2008 at 11:40 AM, Peter Koczan <pjkoczan@gmail.com> wrote:
> Hi all,
>
>  I just upgraded one of my servers and I'm having a bit of trouble
>  getting some of the kerberos authentication bits working.
>  Specifically, any Kerberos instance run out of a v5srvtab doesn't work
>  so well. Using stashed tickets or normal principals worked fine.
>  Gritty details follow.
>
>  Peter
>
>  Here are details from the specific v5srvtab's...
>  [root@sensei postgres]# klist -k -t /etc/v5srvtab.wsbackup
>  Keytab name: FILE:/etc/v5srvtab.wsbackup
>  KVNO Timestamp         Principal
>  ---- ----------------- --------------------------------------------------------
>   13 12/20/07 15:56:11 wsbackup/sensei.cs.wisc.edu@CS.WISC.EDU

Here's what happens when I do this (it's on a different machine but
it's the same mechanism).

[root@ator] ~ $ su - wsbackup
ator(1)% kinit -f -k -t /etc/v5srvtab.wsbackup -l 1d
wsbackup/ator.cs.wisc.edu@CS.WISC.EDU
ator(2)% klist
Ticket cache: FILE:/var/adm/krb5/tmp/tkt/krb5cc_28528
Default principal: wsbackup/ator.cs.wisc.edu@CS.WISC.EDU

Valid starting     Expires            Service principal
04/18/08 12:25:00  04/19/08 12:25:00  krbtgt/CS.WISC.EDU@CS.WISC.EDU


Kerberos 4 ticket cache: /tmp/tkt28528
klist: You have no tickets cached
ator(4)% /s/postgresql-8.2/bin/psql -h sensei -p 5432 postgres
Connecting to 8.2 works...

ator(5)% /s/postgresql-8.3/bin/psql -h sensei -p 5432 postgres
Connecting to 8.2 via 8.3 binaries works...

ator(6)% /s/postgresql-8.3/bin/psql -h sensei -p 49173 postgres
psql: FATAL:  no pg_hba.conf entry for host "128.105.162.36", user
"wsbackup", database "postgres", SSL off

And then it fails as above...
Apr 18 12:20:41 sensei postgres[4486]: [3-1] LOG:  connection
received: host=ator.cs.wisc.edu port=56925
Apr 18 12:20:41 sensei postgres[4486]: [4-1] LOG:  unexpected Kerberos
user name received from client (received "wsbackup", expected
"wsbackup/ator.cs.wisc.edu")
Apr 18 12:20:41 sensei postgres[4486]: [5-1] FATAL:  Kerberos 5
authentication failed for user "wsbackup"
Apr 18 12:20:41 sensei postgres[4488]: [3-1] LOG:  connection
received: host=ator.cs.wisc.edu port=56926
Apr 18 12:20:41 sensei postgres[4488]: [4-1] FATAL:  no pg_hba.conf
entry for host "128.105.162.36", user "wsbackup", database "postgres",
SSL off

And this is what syslog shows when I try GSSAPI authentication.
Apr 18 12:34:40 sensei postgres[25885]: [3-1] LOG:  connection
received: host=ator.cs.wisc.edu port=41148
Apr 18 12:34:40 sensei postgres[25885]: [4-1] FATAL:  GSSAPI
authentication failed for user "wsbackup"
Apr 18 12:34:40 sensei postgres[25886]: [3-1] LOG:  connection
received: host=ator.cs.wisc.edu port=41149
Apr 18 12:34:40 sensei postgres[25886]: [4-1] FATAL:  no pg_hba.conf
entry for host "128.105.162.36", user "wsbackup", database "postgres",
SSL off

Is this something I'm just going to have to find a way to work around
or should I file a bug report?

Peter