Date: Thu, 15 Sep 2022 18:32:41 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Sylvain Deveaux <Sylvain.Deveaux@niwa.co.nz>
Cc: "pgsql-admin@lists.postgresql.org" <pgsql-admin@lists.postgresql.org>
Subject: Re: Ldap config for Active Directory
Message-ID: <YyOoCeCFzP71ziRG@tamriel.snowman.net>
References: <b41288eedb459fdc31ac2f05cef0401f3d8a73b6.camel@niwa.co.nz>
 <YyN6HuBhtzaObYLR@tamriel.snowman.net>
 <7f75b5d2f3c58b8d42c1012c784555d05f5f2124.camel@niwa.co.nz>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="6ZvAr7O3DbRbEfeb"
Content-Disposition: inline
In-Reply-To: <7f75b5d2f3c58b8d42c1012c784555d05f5f2124.camel@niwa.co.nz>
User-Agent: Mutt/2.1.4 (2021-12-11)
Archived-At: 
 <https://www.postgresql.org/message-id/YyOoCeCFzP71ziRG%40tamriel.snowman.net>
Precedence: bulk


--6ZvAr7O3DbRbEfeb
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Sylvain Deveaux (Sylvain.Deveaux@niwa.co.nz) wrote:
> Why do you say that you can't use kerberos w/ apps?
>=20
> I prefer to not reply to this one otherwise I won't be kind with some peo=
ple... =F0=9F=98=85=EF=B8=8F

=2E.. ok, but let's try to make clear the distinction of "$people won't
let me do this" from "this isn't possible" when posting, as otherwise
people who read the lists may get misled or confused.

> Note that using ldap auth means sending the user's password to the PG
> server in cleartext, which is extremely insecure and means that a
> compromised PG server could be used to steal the credentials of any user
> logging in using this method.
>=20
> I agree... but for now I can't switch a to full Kerberos setup...

I'd suggest you push back a bit harder on this as it's much, much more
secure to use Kerberos and it's how all the various services in the AD
world operate.  Services that pass passwords around in cleartext are
really very insecure.

Thanks,

Stephen

--6ZvAr7O3DbRbEfeb
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEwf6gbxKhD863zrx/7WyKOINHZFUFAmMjqAcACgkQ7WyKOINH
ZFU+gw//ZozbcdQOb+7IWKx1ZQZe9jttd51Gf8NtQ44OLjvgUcF3TpEc3/8FrZGQ
FXvpwGZKmgUGRqwfcSsFl7HeP6dK+rnHG1gd0XsfnTiYCU45KRPeX3goqCiV2qQl
iPtyP7x8pk8mOiT4SaBpyU179Z9SV5dP0BWilXmZ47hykhJvinNd0w4zwtMm0IZF
GOuzR6DAloJAYboXIQMlHB4szcldyTk9mqgRMx+cljFv/tDwothnjJC3c6Ven7ip
1+q4SS22Sov5niJ46MNVo/TtRSDYK8ZcGOEydnVX1l3Qg32UqoycSp/73LTIjEyH
WfbPpYOJOuGto6uK37bv4cHTip7+oN44fdsE5UJO0EWLkKDOjS3kI1jGkv1OV+Ss
3x6pM0Wh/KajwzZbnODrq+sQbo4rLyVmFnNNgMZzk9X084jcXtc6hU7wknA6XP3h
8BQ+oUTl8uVr5UkIZvMYol/hbBqd3a2iVUrMSyl7Kpn2MkYFTJxa6tBnVPHHm4pV
r8h/Mh1K8JnsSAGZbV8vXps7/HzFBX+t1omZxDHBk9/mNncTD8mlRUsUjO9bIR/a
KNBDE+BZWslPVz4MYahrF3crmmMzG5SDUz7L0ayrQIH6UfSvY4Rb6DcPagsSsq2/
8F3F9uuByd4ouWiXQEko45Ljgbbz68vWXXkGrzaRmBST/Ubnbsw=
=NnuC
-----END PGP SIGNATURE-----

--6ZvAr7O3DbRbEfeb--