From: Stephen Frost <sfrost@snowman.net>
To: Sylvain Deveaux <Sylvain.Deveaux@niwa.co.nz>
Cc: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Subject: Re: Ldap config for Active Directory
Date: Thu, 15 Sep 2022 15:16:46 -0400
Message-ID: <YyN6HuBhtzaObYLR@tamriel.snowman.net> (raw)
In-Reply-To: <b41288eedb459fdc31ac2f05cef0401f3d8a73b6.camel@niwa.co.nz>
References: <b41288eedb459fdc31ac2f05cef0401f3d8a73b6.camel@niwa.co.nz>
Greetings,
* Sylvain Deveaux (Sylvain.Deveaux@niwa.co.nz) wrote:
> We have to use LDAP in our AD environment, Users could use Kerberos but service accounts used by Apps can't.
Why do you say that you can't use kerberos w/ apps?
> host all +ldap_roles 192.168.0.0/16 ldap ldapurl="ldap://ldap.service:636/ou=AdminOU,dc=domain,dc=org?sAMAccountName?sub" ldapbinddn="cn=postgres_bind,ou=level1,ou=level2,dc=domain,dc=org" ldapbindpasswd="password"
Note that using ldap auth means sending the user's password to the PG
server in cleartext, which is extremely insecure and means that a
compromised PG server could be used to steal the credentials of any user
logging in using this method.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 832B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, Sylvain.Deveaux@niwa.co.nz, pgsql-admin@lists.postgresql.org
Subject: Re: Ldap config for Active Directory
In-Reply-To: <YyN6HuBhtzaObYLR@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox