From: Holger Jakobs <holger@jakobs.com>
To: pgsql-admin@lists.postgresql.org
Cc: bernd.lentes@helmholtz-muenchen.de
Subject: Re: Update "usename" in pg_user
Date: Tue, 14 Nov 2023 15:51:53 +0100
Message-ID: <6d800f7b-47e3-08e1-2a9e-0cd561af64cd@jakobs.com> (raw)
In-Reply-To: <PR3PR04MB73409EB3F2695DA61418F784D6B2A@PR3PR04MB7340.eurprd04.prod.outlook.com>
References: <PR3PR04MB73409EB3F2695DA61418F784D6B2A@PR3PR04MB7340.eurprd04.prod.outlook.com>
Am 14.11.23 um 13:56 schrieb Bernd Lentes:
> Hi,
>
> the last time i wrote a SQL command is about 20 years ago.
> So I'm asking for your advice.
> I have a DB which is accessed by ~ 40 users.
> The users are in pg_user and authenticated with LDAP.
There have been several warnings on this list about using LDAP for
authentication.
I quote one of them:
PostgreSQL supports GSSAPI / Kerberos, which is a much better
approach in Active Directory and other environments where Kerberos
is deployed.
Using LDAP exposes the user's password to the database server and
therefore isn't secure and should be strongly discouraged.
You can certainly have applications authenticate to PostgreSQL using
Kerberos too with very little overhead (unlike PG's LDAP
authentication option, which makes a synchronous call out to the
LDAP server on each and every login).
If you insist on using LDAP, you might use the regexp feature to extract
the username from the complete mail address. Only if the same user name
with different server parts (after the @) exist, you'll have to change
your user names.
Quoted user names are very much unloved.
Regards,
Holgr
> --
> Holger Jakobs, PostgreSQL Expert and Trainer, Bergisch Gladbach, Tel. +49-178-9759012
Attachments:
[application/pgp-signature] OpenPGP_signature (202B, ../6d800f7b-47e3-08e1-2a9e-0cd561af64cd@jakobs.com/3-OpenPGP_signature)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: holger@jakobs.com, pgsql-admin@lists.postgresql.org, bernd.lentes@helmholtz-muenchen.de
Subject: Re: Update "usename" in pg_user
In-Reply-To: <6d800f7b-47e3-08e1-2a9e-0cd561af64cd@jakobs.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox