DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com;
	h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
	b=MRqbzo+0zuO2DvHt3UGWARydfOU+Z6ThckAHkRn5xD4Vi8E7DebIKcoQOdw7apjC0ciwC3qdhoBYSsCpUsvHF49JnLE0MjwpH0AJIa1G8v2HFOqHCzTWMsTusP3RKnnUQ7BiW4aDyRTxhrQBTZid8/7YGoMFjQ7kozu0F/e5RfY=;
Message-ID: <550788.6989.qm@web39702.mail.mud.yahoo.com>
Date: Fri, 1 Oct 2010 14:50:38 -0700 (PDT)
From: Bob Lunney <bob_lunney@yahoo.com>
Subject: GSS for both Windows and Linux
To: pgsql-admin@postgresql.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii

Is it possible to have clients authenticate via Kerberos to a PG 8.4 server running on linux from both linux and windows hosts?  I have authentication working (using GSSAPI) between the linux clients and the server.  I'd like to use the Windows binary install (which already has GSSAPI compiled in) against the linux-based database server.  

o  Do I need to have separate AD principals for the Windows clients or is it possible for Windows clients to get a ticket granting ticket from the linux-based KDC?

o  How do I combine the linux and Windows keytab files the server needs to authenticate if separate principals are required?

o  Since Windows (mis)uses "POSTGRES" and linux uses "postgres" for the service name, do I need to force either one to use the other's service name, since the database server can only use one version? 

Any pointers will be appreciated.  I've scoured Google  but can't find the missing piece of information I need to get Windows clients working.  Thanks in advance!

Bob Lunney