From: Stephen Frost <sfrost@snowman.net>
To: Sylvain Deveaux <Sylvain.Deveaux@niwa.co.nz>
Cc: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Subject: Re: Ldap config for Active Directory
Date: Thu, 15 Sep 2022 18:32:41 -0400
Message-ID: <YyOoCeCFzP71ziRG@tamriel.snowman.net> (raw)
In-Reply-To: <7f75b5d2f3c58b8d42c1012c784555d05f5f2124.camel@niwa.co.nz>
References: <b41288eedb459fdc31ac2f05cef0401f3d8a73b6.camel@niwa.co.nz>
<YyN6HuBhtzaObYLR@tamriel.snowman.net>
<7f75b5d2f3c58b8d42c1012c784555d05f5f2124.camel@niwa.co.nz>
Greetings,
* Sylvain Deveaux (Sylvain.Deveaux@niwa.co.nz) wrote:
> Why do you say that you can't use kerberos w/ apps?
>
> I prefer to not reply to this one otherwise I won't be kind with some people... 😅️
... ok, but let's try to make clear the distinction of "$people won't
let me do this" from "this isn't possible" when posting, as otherwise
people who read the lists may get misled or confused.
> Note that using ldap auth means sending the user's password to the PG
> server in cleartext, which is extremely insecure and means that a
> compromised PG server could be used to steal the credentials of any user
> logging in using this method.
>
> I agree... but for now I can't switch a to full Kerberos setup...
I'd suggest you push back a bit harder on this as it's much, much more
secure to use Kerberos and it's how all the various services in the AD
world operate. Services that pass passwords around in cleartext are
really very insecure.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 832B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, Sylvain.Deveaux@niwa.co.nz, pgsql-admin@lists.postgresql.org
Subject: Re: Ldap config for Active Directory
In-Reply-To: <YyOoCeCFzP71ziRG@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox