Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1r03OH-002xUs-Rr for pgsql-admin@arkaria.postgresql.org; Mon, 06 Nov 2023 17:27:58 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1r03OE-000ABZ-Qw for pgsql-admin@arkaria.postgresql.org; Mon, 06 Nov 2023 17:27:54 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1r03OE-000ABR-4V for pgsql-admin@lists.postgresql.org; Mon, 06 Nov 2023 17:27:54 +0000 Received: from tamriel.snowman.net ([70.109.60.50]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1r03OB-004GiA-Fo for pgsql-admin@lists.postgresql.org; Mon, 06 Nov 2023 17:27:52 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 233C05F7B7; Mon, 6 Nov 2023 12:27:46 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=snowman.net; s=dkim; t=1699291666; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=iXIpg54nPay1fZK07k8YP9R97TTLCPaT3u4WFPniTfs=; b=gOCdt7L7T5sYRT84ydwmP7c1SSgU3nXjngbrOPC5GMomP+Rd6JzZAVuCP3YeuDHmGtqE3n peqkCNIHU6zFMy/kd/vEKiEBmUibwUB8ymHlsZR8As1qFFfvVuAxSsCmm4tIfTufoIAHYA dDqYIRzZlfHnaoE1VsGMWisD6WHxw3c= Date: Mon, 6 Nov 2023 12:27:46 -0500 From: Stephen Frost To: Bernd Lentes Cc: Pgsql-admin Subject: Re: unrecognized configuration parameter "ldapbinddn" in file "/var/lib/pgsql/data/postgresql.conf" Message-ID: References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="hlQvedd7JV7Mq9q1" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/2.1.4 (2021-12-11) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --hlQvedd7JV7Mq9q1 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Greetings, * Bernd Lentes (bernd.lentes@helmholtz-muenchen.de) wrote: > i'm trying to use LDAP to authenticate Postgres against a Windows AD. On elder versions it succeeded. You really shouldn't use the 'ldap' auth method in PostgreSQL as it involves passing around a cleartext password to work. With Windows AD, you can use Kerberos which is what all of the Microsoft applications use for authentication too, avoids users having to ever enter in their password, avoids having users end up saving their domain password into cliet tools like pgAdmin, and is just overall far, far, better and much more secure. Note that in PostgreSQL, the Kerberos auth method is 'gssapi'. Thanks, Stephen --hlQvedd7JV7Mq9q1 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEwf6gbxKhD863zrx/7WyKOINHZFUFAmVJIg8ACgkQ7WyKOINH ZFXLexAAhBiaPTRNUI5hIPeyXS2k9Mxm6WhfTyL9D7x+o0+YIj/IMw2Img1W8Dlr 5PxKcSgtZxTsdC8tI8y3aopVrRk3i7YGpzM6UOPiaHoHkZx1iOtMr0MR941NnPT2 g2zmUY3RQv/jhVtT1mXDDNfRSYQXJbLDCAAFI0B1CamTBcSkmAEG+pNTPeRimD3c Bfcq4MbSh6lUVHV9gMAvypSFa7Ra2ZytSEmWro5GA4z79lOYeQYfmplM4+RHQ95w Lm9U0d7MlzDFrfoAm7sDLqrS0+++iErW2a/c6PGA2t+AiR3a1Svj72Y5KZ8kbY55 XgLAC4NJc6cEi2050771F8/5927f3yOX31uyueF+j1KU7l36qhnSJK1j1ren6Wv/ F1oizH5zyA6vnqbPTvXbzEkG0TYCX7JeklxNGsl5N6CHmGnEGLyWnBPvg6jFUQ4g GVDSmHekCg+elUD6HUGuRjsY3HByF/isWDA3ZtMwQH6oPKOkzh1hgU1IKy2HKAgG VJI3hVnjHOTvr3mEFi7r9ltXt4mEbTcWAxAZMxIyv6yfQ5kWH7oT/teFgqvixM7K AXI3zrNlDK0M7E37cVjyF+KiEQqFp1IG67yjGOxI4JgiAKbVyRpV2v3ppk50toRY fTKfXdJe0wF60vIe98SVBGyUI4OmGWSLIrZhH5FRAZab/wizyGU= =hyOD -----END PGP SIGNATURE----- --hlQvedd7JV7Mq9q1--