From: Holger Jakobs <holger@jakobs.com>
To: pgsql-admin@lists.postgresql.org
Subject: Re: Use AD-account as login into Postgres.
Date: Fri, 9 Feb 2024 20:34:42 +0100
Message-ID: <954de75f-5e5a-e5a9-0c64-3e0b030f3957@jakobs.com> (raw)
In-Reply-To: <GV1P189MB2132634A059A3C37E102BF83A24B2@GV1P189MB2132.EURP189.PROD.OUTLOOK.COM>
References: <GV1P189MB2132400900DA53D139B09DAFA24B2@GV1P189MB2132.EURP189.PROD.OUTLOOK.COM>
<09c4b7dc-901d-135e-087b-808c489e0d81@jakobs.com>
<GV1P189MB2132634A059A3C37E102BF83A24B2@GV1P189MB2132.EURP189.PROD.OUTLOOK.COM>
Am 09.02.24 um 20:31 schrieb Pär Mattsson:
> Yes this is a complete windows installation of Postgres and they will
> use ad-login account into the database
>
> Mvh Pär
> ------------------------------------------------------------------------
> *Från:* Holger Jakobs <holger@jakobs.com>
> *Skickat:* fredag, februari 9, 2024 20:05
> *Till:* pgsql-admin@lists.postgresql.org
> <pgsql-admin@lists.postgresql.org>
> *Ämne:* Re: Use AD-account as login into Postgres.
> Am 09.02.24 um 19:31 schrieb Pär Mattsson:
>> Hi!
>> Is it only to config in hba.conf the connection info, to use
>> AD-accounts to login in postgres.
>> This is a windows/postres intallation 🤦♂️✌️
>>
>> Mvh Pär
>> +46706069645
>
> Hi,
>
> Short answer: No!
>
> SSPI using AD accounts for authentication works only in a complete
> Windows environment. The client and the server machine have to be
> member of the same AD environment, which isn't possible for
> non-Windows machines. Otherwise, there is no trust between the machines.
>
> An automatic creation of PostgreSQL roles from AD accounts has to be
> done outside PostgreSQL, i. e. by a script running regularly.
>
> A couple of years ago, I wrote such a script for a customer.
>
> Regards,
>
> Holger
>
If that's the case, create all the necessary roles (groups, users) in
PostgreSQL matching entries in pg_hba.conf and mapping entries in
pg_ident, so that Windows users can connect to the database without
needing to authenticate again.
It's a nice way of providing single sign-on.
Regards,
Holger
> --
> Holger Jakobs, Bergisch Gladbach, Tel. +49-178-9759012
--
Holger Jakobs, Bergisch Gladbach, Tel. +49-178-9759012
Attachments:
[application/pgp-signature] OpenPGP_signature (202B, ../954de75f-5e5a-e5a9-0c64-3e0b030f3957@jakobs.com/3-OpenPGP_signature)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: holger@jakobs.com, pgsql-admin@lists.postgresql.org
Subject: Re: Use AD-account as login into Postgres.
In-Reply-To: <954de75f-5e5a-e5a9-0c64-3e0b030f3957@jakobs.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox