Received: from maia.hub.org (maia-3.hub.org [200.46.204.243]) by mail.postgresql.org (Postfix) with ESMTP id 910011337B4F for ; Fri, 29 Oct 2010 02:53:04 -0300 (ADT) Received: from mail.postgresql.org ([200.46.204.86]) by maia.hub.org (mx1.hub.org [200.46.204.243]) (amavisd-maia, port 10024) with ESMTP id 58514-01 for ; Fri, 29 Oct 2010 05:52:57 +0000 (UTC) X-Greylist: delayed 00:40:33.279521 by SQLgrey-1.7.6 Received: from mail.kzsdabas.sulinet.hu (szerver1.kzsdabas.sulinet.hu [195.199.159.209]) by mail.postgresql.org (Postfix) with SMTP id 5F3691336DB6 for ; Fri, 29 Oct 2010 02:52:56 -0300 (ADT) Received: from [192.168.13.1] by mail.kzsdabas.hu with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.69) (envelope-from ) id 1PBhG7-0006gj-8W for pgsql-admin@postgresql.org; Fri, 29 Oct 2010 07:12:18 +0200 Message-ID: <4CCA57A4.4010700@kzsdabas.hu> Date: Fri, 29 Oct 2010 07:12:04 +0200 From: =?ISO-8859-1?Q?G=E9mes_G=E9za?= User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.14) Gecko/20101006 Thunderbird/3.0.9 MIME-Version: 1.0 To: pgsql-admin@postgresql.org References: In-Reply-To: Content-Type: multipart/alternative; boundary="------------000105090408040206040209" X-SA-Exim-Connect-IP: 192.168.13.1 X-SA-Exim-Mail-From: geza@kzsdabas.hu Subject: Re: Using LDAP with postgresql 8.2 X-SA-Exim-Version: 4.2.1 (built Wed, 25 Jun 2008 17:20:07 +0000) X-SA-Exim-Scanned: Yes (on mail.kzsdabas.hu) X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=-1.899 tagged_above=-10 required=5 tests=BAYES_00=-1.9, HTML_MESSAGE=0.001 X-Spam-Level: X-Archive-Number: 201010/223 X-Sequence-Number: 35964 This is a multi-part message in MIME format. --------------000105090408040206040209 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Hi, I'm not an AD expert myself, but I've read somewhere, that AD disallows simple binds without using ssl. You could try enabling ssl on AD, or try the krb5 authentication method for pg. Good Luck Geza > > I've setup LDAP on Postgresql 8.3.6 by adding the following line to > pg_hba.conf. My Active Directory has a group called 'users group' > which contains an entry for user pgtest. > > host all pgtest xx.xxx.x.x/xx ldap > "ldap://server.mydomain.com:389/basedn;cn=;,ou=users > group,dc=mydomain,dc=com" > > I have restarted the PG server but when I try to connect via psql from > another host, I get the following error: - > > 2010-10-28 16:30:36 BST [1095]: [2-1] FATAL: LDAP authentication > failed for user "pgtest" > 2010-10-28 16:30:36 BST [1096]: [1-1] LOG: LDAP login failed for user > "cn=pgtest,ou=users group,dc=mydomain,dc=com" on server > "server.mydomain.com": error code 49 > > So it looks like the cn, ou and dc parameters are correct, but for > some reason Openldap is returning error 49, which is a generic > authentication failure message. > > Can anyone suggest anything that I might be doing wrong? Could it be > the line in pg_hba.conf that is wrong, or possibly the ldap package on > the server (debian linux) not working > properly? > > Any ideas much appreciated! > > > ------------------------------------------------------------------------ > From: kierenscott@hotmail.com > To: pgsql-admin@postgresql.org > Subject: Using LDAP with postgresql 8.2 > Date: Wed, 27 Oct 2010 17:57:32 +0000 > > Hi, > > I'm looking to implement LDAP authentication againt Active Directory > for my > Postgresql databases. What's people experiences of using LDAP for > authenticating logins with AD? > Is it easy to setup and is there anything to watch out for e.g. does > Postgresql do anything > intrusive on Active Directory (create anything) or does it just simply > bind to AD, validate the > username/password pair and return success/failure back to the client? > > Many thanks! --------------000105090408040206040209 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Hi,
I'm not an AD expert myself, but I've read somewhere, that AD disallows simple binds without using ssl.
You could try enabling ssl on AD, or try the krb5 authentication method for pg.

Good Luck

Geza

I've setup LDAP on Postgresql 8.3.6 by adding the following line to pg_hba.conf. My Active Directory has a group called 'users group' which contains an entry for user pgtest.

host   all   pgtest    xx.xxx.x.x/xx      ldap "ldap://server.mydomain.com:389/basedn;cn=;,ou=users group,dc=mydomain,dc=com"

I have restarted the PG server but when I try to connect via psql from another host, I get the following error: -

2010-10-28 16:30:36 BST [1095]: [2-1] FATAL:  LDAP authentication failed for user "pgtest"
2010-10-28 16:30:36 BST [1096]: [1-1] LOG:  LDAP login failed for user "cn=pgtest,ou=users group,dc=mydomain,dc=com" on server "server.mydomain.com": error code 49

So it looks like the cn, ou and dc parameters are correct, but for some reason Openldap is returning error 49, which is a generic authentication failure message.

Can anyone suggest anything that I might be doing wrong? Could it be the line in pg_hba.conf that is wrong, or possibly the ldap package on the server (debian linux) not working
 properly?

Any ideas much appreciated!


From: kierenscott@hotmail.com
To: pgsql-admin@postgresql.org
Subject: Using LDAP with postgresql 8.2
Date: Wed, 27 Oct 2010 17:57:32 +0000

Hi,

I'm looking to implement LDAP authentication againt Active Directory for my
Postgresql databases. What's people experiences of using LDAP for authenticating logins with AD?
Is it easy to setup and is there anything to watch out for e.g. does Postgresql do anything
intrusive on Active Directory (create anything) or does it just simply bind to AD, validate the
username/password pair and return success/failure back to the client?

Many thanks!

--------------000105090408040206040209--