pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedLDAP and roles
5+ messages / 4 participants
[nested] [flat]
* LDAP and roles
@ 2020-12-08 20:12 Ron <ronljohnsonjr@gmail.com>
0 siblings, 3 replies; 5+ messages in thread
From: Ron @ 2020-12-08 20:12 UTC (permalink / raw)
To: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Does LDAP obviate the need for the PASSWORD clause of CREATE ROLE? It sounds
obvious, but I wanted to verify before deciding whether or not to try LDAP,
and did not see any reference in
https://www.postgresql.org/docs/12/sql-createrole.html.
Thanks
--
Angular momentum makes the world go 'round.
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: LDAP and roles
@ 2020-12-08 21:15 Tom Lane <tgl@sss.pgh.pa.us>
parent: Ron <ronljohnsonjr@gmail.com>
2 siblings, 1 reply; 5+ messages in thread
From: Tom Lane @ 2020-12-08 21:15 UTC (permalink / raw)
To: Ron <ronljohnsonjr@gmail.com>; +Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Ron <ronljohnsonjr@gmail.com> writes:
> Does LDAP obviate the need for the PASSWORD clause of CREATE ROLE?
Well, it won't use that password, if that's what you mean.
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: LDAP and roles
@ 2020-12-08 21:40 Ron <ronljohnsonjr@gmail.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 5+ messages in thread
From: Ron @ 2020-12-08 21:40 UTC (permalink / raw)
To: Pgsql-admin <pgsql-admin@lists.postgresql.org>
On 12/8/20 3:15 PM, Tom Lane wrote:
> Ron <ronljohnsonjr@gmail.com> writes:
>> Does LDAP obviate the need for the PASSWORD clause of CREATE ROLE?
> Well, it won't use that password, if that's what you mean.
That's what I meant.
--
Angular momentum makes the world go 'round.
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: LDAP and roles
@ 2020-12-09 08:50 Paul Förster <paul.foerster@gmail.com>
parent: Ron <ronljohnsonjr@gmail.com>
2 siblings, 0 replies; 5+ messages in thread
From: Paul Förster @ 2020-12-09 08:50 UTC (permalink / raw)
To: Ron <ronljohnsonjr@gmail.com>; +Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Hi Ron,
> On 08. Dec, 2020, at 21:12, Ron <ronljohnsonjr@gmail.com> wrote:
>
> Does LDAP obviate the need for the PASSWORD clause of CREATE ROLE?
yes, it does. We use it all the time.
create role <name> login;
grant <approle> to name;
It works with us this way. The user/role is otherwise completely managed in LDAP, including password policies, etc.
Cheers,
Paul
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: LDAP and roles
@ 2020-12-09 16:30 Stephen Frost <sfrost@snowman.net>
parent: Ron <ronljohnsonjr@gmail.com>
2 siblings, 0 replies; 5+ messages in thread
From: Stephen Frost @ 2020-12-09 16:30 UTC (permalink / raw)
To: Ron <ronljohnsonjr@gmail.com>; +Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Greetings,
* Ron (ronljohnsonjr@gmail.com) wrote:
> Does LDAP obviate the need for the PASSWORD clause of CREATE ROLE? It sounds
> obvious, but I wanted to verify before deciding whether or not to try LDAP,
> and did not see any reference in
> https://www.postgresql.org/docs/12/sql-createrole.html.
Using GSSAPI also results in the password not being needed to be set for
the role, and is actually secure, unlike LDAP-based auth where the
user's password is happily sent in the clear to the PG server.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2020-12-09 16:30 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2020-12-08 20:12 LDAP and roles Ron <ronljohnsonjr@gmail.com>
2020-12-08 21:15 ` Tom Lane <tgl@sss.pgh.pa.us>
2020-12-08 21:40 ` Ron <ronljohnsonjr@gmail.com>
2020-12-09 08:50 ` Paul Förster <paul.foerster@gmail.com>
2020-12-09 16:30 ` Stephen Frost <sfrost@snowman.net>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox