From: Eugene Budanov <eugene.budanov@rosalab.ru>
To: pgsql-admin@postgresql.org
Subject: Kerberized login to Postgres database
Date: Tue, 10 Jan 2012 09:05:14 +0300 (MSK)
Message-ID: <481045983.5980.1326175514267.JavaMail.root@collab.rosalab.ru> (raw)
In-Reply-To: <492130707.5978.1326175292699.JavaMail.root@collab.rosalab.ru>
Hi all!
I have a problem with kerberizing PostgreSQL 9.1.1.
PostgreSQL and Kerberos installed at different computers in network. I'm using internal network in VirtualBox 4.1.6.
There are no firewalls on both machines.
So, let's see pg_hba.conf:
less /var/lib/pgsql/data/pg_hba.conf
# TYPE DATABASE USER ADDRESS METHOD
# "local" is for Unix domain socket connections only
local all all trust
# IPv4 local connections:
host all all 127.0.0.1/32 trust
host all all 192.168.100.0/24 krb5
And content of my postgresql.conf
# Kerberos and GSSAPI
krb_server_keyfile = '/var/lib/pgsql/data/krb5.keytab'
#krb_srvname = 'postgres' # (Kerberos only)
#krb_caseins_users = off
Pricipals in keytab file:
postgres/db.domain.int@DOMAIN.INT
host/db.domain.int@DOMAIN.INT
Passwords for principals in keytab randomly generated by kadmin.local during export to keytab.
User postgres is exists in database of course.
Now, let's try connect to postgres database through kerberos:
[postgres@localhost eugene]$ kinit postgres
Password for postgres@DOMAIN.INT:
[postgres@localhost eugene]$ klist
Ticket cache: FILE:/tmp/krb5cc_481
Default principal: postgres@DOMAIN.INT
Valid starting Expires Service principal
12/30/11 12:21:14 12/31/11 12:21:14 krbtgt/DOMAIN.INT@DOMAIN.INT
renew until 01/06/12 12:21:14
All works good. Other services such as kerberized login for operating system works fine.
But if try connect to postgres database:
[postgres@localhost eugene]$ psql -h 192.168.100.10 -U postgres
psql: Kerberos 5 authentication rejected: Wrong principal in request
What I'am doing wrong? Any ideas? Questions?
Thanks in advance for your help.
---
Best regards,
Budanov Eugene
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: eugene.budanov@rosalab.ru
Subject: Re: Kerberized login to Postgres database
In-Reply-To: <481045983.5980.1326175514267.JavaMail.root@collab.rosalab.ru>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox