Received: from maia.hub.org (maia-3.hub.org [200.46.204.243]) by mail.postgresql.org (Postfix) with ESMTP id D2DF81337B82 for ; Fri, 29 Oct 2010 16:36:07 -0300 (ADT) Received: from mail.postgresql.org ([200.46.204.86]) by maia.hub.org (mx1.hub.org [200.46.204.243]) (amavisd-maia, port 10024) with ESMTP id 67621-07 for ; Fri, 29 Oct 2010 19:36:00 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from mail.int.journyx.com (mail.journyx.com [66.219.41.227]) by mail.postgresql.org (Postfix) with ESMTP id 252AC1336DB6 for ; Fri, 29 Oct 2010 16:36:00 -0300 (ADT) Received: from localhost (localhost.localdomain [127.0.0.1]) by mail.int.journyx.com (Postfix) with ESMTP id E64CB7E5BE2; Fri, 29 Oct 2010 14:35:58 -0500 (CDT) X-Virus-Scanned: amavisd-new at zimbra.int.journyx.com Received: from mail.int.journyx.com ([127.0.0.1]) by localhost (mail.int.journyx.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S0+tkeAVN9Ov; Fri, 29 Oct 2010 14:35:46 -0500 (CDT) Received: from mail.int.journyx.com (zimbra.int.journyx.com [192.168.100.5]) by mail.int.journyx.com (Postfix) with ESMTP id F1C2EC4208; Fri, 29 Oct 2010 14:35:45 -0500 (CDT) Date: Fri, 29 Oct 2010 14:35:45 -0500 (CDT) From: Scott Whitney Reply-To: Scott Whitney To: =?utf-8?Q?G=C3=A9mes_G=C3=A9za?= Cc: pgsql-admin@postgresql.org Message-ID: <8247833.8831.1288380945784.JavaMail.root@zimbra.int.journyx.com> In-Reply-To: <4CCB206D.3040204@kzsdabas.hu> Subject: Re: Using LDAP with postgresql 8.2 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_8830_17118102.1288380945782" X-Originating-IP: [192.168.100.188] X-Mailer: Zimbra 6.0.6_GA_2331.RHEL4 (ZimbraWebClient - FF3.0 (Win)/6.0.6_GA_2331.RHEL4) X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=-1.909 tagged_above=-10 required=5 tests=BAYES_00=-1.9, HTML_MESSAGE=0.001, T_RP_MATCHES_RCVD=-0.01 X-Spam-Level: X-Archive-Number: 201010/217 X-Sequence-Number: 35958 ------=_Part_8830_17118102.1288380945782 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit There are ways to enable it, but in general, yes, you're right. In AD you have to do some magic to bind if you're not part of the actual AD forest. Hi, I'm not an AD expert myself, but I've read somewhere, that AD disallows simple binds without using ssl. You could try enabling ssl on AD, or try the krb5 authentication method for pg. Good Luck Geza > > I've setup LDAP on Postgresql 8.3.6 by adding the following line to > pg_hba.conf. My Active Directory has a group called 'users group' > which contains an entry for user pgtest. > > host all pgtest xx.xxx.x.x/xx ldap > "ldap://server.mydomain.com:389/basedn;cn=;,ou=users > group,dc=mydomain,dc=com" > > I have restarted the PG server but when I try to connect via psql from > another host, I get the following error: - > > 2010-10-28 16:30:36 BST [1095]: [2-1] FATAL: LDAP authentication > failed for user "pgtest" > 2010-10-28 16:30:36 BST [1096]: [1-1] LOG: LDAP login failed for user > "cn=pgtest,ou=users group,dc=mydomain,dc=com" on server > "server.mydomain.com": error code 49 > > So it looks like the cn, ou and dc parameters are correct, but for > some reason Openldap is returning error 49, which is a generic > authentication failure message. > > Can anyone suggest anything that I might be doing wrong? Could it be > the line in pg_hba.conf that is wrong, or possibly the ldap package on > the server (debian linux) not working > properly? > > Any ideas much appreciated! > > > ------------------------------------------------------------------------ > From: kierenscott@hotmail.com > To: pgsql-admin@postgresql.org > Subject: Using LDAP with postgresql 8.2 > Date: Wed, 27 Oct 2010 17:57:32 +0000 > > Hi, > > I'm looking to implement LDAP authentication againt Active Directory > for my > Postgresql databases. What's people experiences of using LDAP for > authenticating logins with AD? > Is it easy to setup and is there anything to watch out for e.g. does > Postgresql do anything > intrusive on Active Directory (create anything) or does it just simply > bind to AD, validate the > username/password pair and return success/failure back to the client? > > Many thanks! ------=_Part_8830_17118102.1288380945782 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <= div style=3D'font-family: Times New Roman; font-size: 12pt; color: #000000'= >There are ways to enable it, but in general, yes, you're right. In AD you = have to do some magic to bind if you're not part of the actual AD forest.
Hi,
I'm not an AD expert myself, but = I've read somewhere, that AD disallows
simple binds without using ssl.You could try enabling ssl on AD, or try the krb5 authentication methodfor pg.

Good Luck

Geza
>
> I've setup LDAP on P= ostgresql 8.3.6 by adding the following line to
> pg_hba.conf. My Act= ive Directory has a group called 'users group'
> which contains an en= try for user pgtest.
>
> host   all   pgtest   &= nbsp;xx.xxx.x.x/xx      ldap
> "ldap://server.mydomain= .com:389/basedn;cn=3D;,ou=3Dusers
> group,dc=3Dmydomain,dc=3Dcom"
= >
> I have restarted the PG server but when I try to connect via p= sql from
> another host, I get the following error: -
>
>= 2010-10-28 16:30:36 BST [1095]: [2-1] FATAL:  LDAP authentication
= > failed for user "pgtest"
> 2010-10-28 16:30:36 BST [1096]: [1-1]= LOG:  LDAP login failed for user
> "cn=3Dpgtest,ou=3Dusers grou= p,dc=3Dmydomain,dc=3Dcom" on server
> "server.mydomain.com": error co= de 49
>
> So it looks like the cn, ou and dc parameters are cor= rect, but for
> some reason Openldap is returning error 49, which is = a generic
> authentication failure message.
>
> Can anyon= e suggest anything that I might be doing wrong? Could it be
> the lin= e in pg_hba.conf that is wrong, or possibly the ldap package on
> the= server (debian linux) not working
>  properly?
>
> = Any ideas much appreciated!
>
>
> -----------------------= -------------------------------------------------
> From: kierenscott= @hotmail.com
> To: pgsql-admin@postgresql.org
> Subject: Using = LDAP with postgresql 8.2
> Date: Wed, 27 Oct 2010 17:57:32 +0000
&= gt;
> Hi,
>
> I'm looking to implement LDAP authenticatio= n againt Active Directory
> for my
> Postgresql databases. What= 's people experiences of using LDAP for
> authenticating logins with = AD?
> Is it easy to setup and is there anything to watch out for e.g.= does
> Postgresql do anything
> intrusive on Active Directory = (create anything) or does it just simply
> bind to AD, validate the> username/password pair and return success/failure back to the client= ?
>
> Many thanks!



------=_Part_8830_17118102.1288380945782--