Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1oYuM6-0006OQ-0z for pgsql-admin@arkaria.postgresql.org; Thu, 15 Sep 2022 19:16:58 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1oYuM3-0000zI-Je for pgsql-admin@arkaria.postgresql.org; Thu, 15 Sep 2022 19:16:55 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1oYuM3-0000z9-8a for pgsql-admin@lists.postgresql.org; Thu, 15 Sep 2022 19:16:55 +0000 Received: from tamriel.snowman.net ([2001:470:e38f::11]) by magus.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1oYuLw-0006jI-6n for pgsql-admin@lists.postgresql.org; Thu, 15 Sep 2022 19:16:54 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id F35905F7B7; Thu, 15 Sep 2022 15:16:46 -0400 (EDT) Date: Thu, 15 Sep 2022 15:16:46 -0400 From: Stephen Frost To: Sylvain Deveaux Cc: "pgsql-admin@lists.postgresql.org" Subject: Re: Ldap config for Active Directory Message-ID: References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="xjVVjKi67kUkeoyG" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/2.1.4 (2021-12-11) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --xjVVjKi67kUkeoyG Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Greetings, * Sylvain Deveaux (Sylvain.Deveaux@niwa.co.nz) wrote: > We have to use LDAP in our AD environment, Users could use Kerberos but service accounts used by Apps can't. Why do you say that you can't use kerberos w/ apps? > host all +ldap_roles 192.168.0.0/16 ldap ldapurl="ldap://ldap.service:636/ou=AdminOU,dc=domain,dc=org?sAMAccountName?sub" ldapbinddn="cn=postgres_bind,ou=level1,ou=level2,dc=domain,dc=org" ldapbindpasswd="password" Note that using ldap auth means sending the user's password to the PG server in cleartext, which is extremely insecure and means that a compromised PG server could be used to steal the credentials of any user logging in using this method. Thanks, Stephen --xjVVjKi67kUkeoyG Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEwf6gbxKhD863zrx/7WyKOINHZFUFAmMjehsACgkQ7WyKOINH ZFUlog//RLYOF/y5RcsxLaWYYXabZ+8Oy+FXvyceQ+i23RkEdNeDmVhlniTPoON1 oXbwh5kPBgE3SaT2OGiA+Tc0HmzSfWrBAtb1q0QEdJ+T6eAeouFC0y7MI7EIETbJ PM9gbzw8bjm4uf+y/6MG4mT99xDGIlKO8oUJdZgkKLlLBq/elAcWBrBmslcjWh+Q MlmH0Uj3by6D8Hh/KSxd+SdJS4VtfJaT3beUSKKXS4Np8GFie7TsRpw6zCSJaJzy DCNApNXxhL92iPgHojXJzbA4js570g0YSJlYO/knsNfJvERFHOb21aC+5AA7jdcS tiwh9/JQKikfQ/mi4VnwxXix+ahu3qFiVtgzqwpZHO/OKXYTXOUyMZp/lxUdokXs 4LcE7f/2teETwvIxIIZfHaGa4YZPmZhqhOuwbpSYhGAY75fQDbF+mNczJVkqBuhu R40vbWF5wzmxo6NC9/uIvcbdXsjyrfkfBH+xBkyFZehnvteq6DOhySv8qI15MGxh KOcMDLILUN59wDi+Rl6UJDSvqDf7s27E1yBpD1DQT0tnKU13ZSKaV32PNEA/OCeb qrVGI4cMw1H/DQSkz9Gkn7H9/0F0hlz89+XQuGBkzo42UvVwEUGmRlTqOjvrypww px/udjsDvX5VoyAeFPYHz63tSjQUMXPzGARsMrbm8N1Dg+udYyc= =gd5A -----END PGP SIGNATURE----- --xjVVjKi67kUkeoyG--