From: Stephen Frost <sfrost@snowman.net>
To: Bernd Lentes <bernd.lentes@helmholtz-muenchen.de>
Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: unrecognized configuration parameter "ldapbinddn" in file "/var/lib/pgsql/data/postgresql.conf"
Date: Mon, 6 Nov 2023 12:27:46 -0500
Message-ID: <ZUkiEvdaOYjAvY/U@tamriel.snowman.net> (raw)
In-Reply-To: <PR3PR04MB7340275A4B83BB8BFD48F37BD6A6A@PR3PR04MB7340.eurprd04.prod.outlook.com>
References: <PR3PR04MB7340275A4B83BB8BFD48F37BD6A6A@PR3PR04MB7340.eurprd04.prod.outlook.com>
Greetings,
* Bernd Lentes (bernd.lentes@helmholtz-muenchen.de) wrote:
> i'm trying to use LDAP to authenticate Postgres against a Windows AD. On elder versions it succeeded.
You really shouldn't use the 'ldap' auth method in PostgreSQL as it
involves passing around a cleartext password to work.
With Windows AD, you can use Kerberos which is what all of the Microsoft
applications use for authentication too, avoids users having to ever
enter in their password, avoids having users end up saving their domain
password into cliet tools like pgAdmin, and is just overall far, far,
better and much more secure.
Note that in PostgreSQL, the Kerberos auth method is 'gssapi'.
Thanks,
Stephen
Attachments:
[application/pgp-signature] signature.asc (832B, ../ZUkiEvdaOYjAvY%2FU@tamriel.snowman.net/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, bernd.lentes@helmholtz-muenchen.de, pgsql-admin@lists.postgresql.org
Subject: Re: unrecognized configuration parameter "ldapbinddn" in file "/var/lib/pgsql/data/postgresql.conf"
In-Reply-To: <ZUkiEvdaOYjAvY/U@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox