From: Stephen Frost <sfrost@snowman.net>
To: Holger Jakobs <holger@jakobs.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: Use AD-account as login into Postgres.
Date: Thu, 22 Feb 2024 12:48:40 -0500
Message-ID: <ZdeI+DoZ97jRUXv/@tamriel.snowman.net> (raw)
In-Reply-To: <09c4b7dc-901d-135e-087b-808c489e0d81@jakobs.com>
References: <GV1P189MB2132400900DA53D139B09DAFA24B2@GV1P189MB2132.EURP189.PROD.OUTLOOK.COM>
<09c4b7dc-901d-135e-087b-808c489e0d81@jakobs.com>
Greetings,
* Holger Jakobs (holger@jakobs.com) wrote:
> SSPI using AD accounts for authentication works only in a complete Windows
> environment. The client and the server machine have to be member of the same
> AD environment, which isn't possible for non-Windows machines. Otherwise,
> there is no trust between the machines.
This isn't accurate- you can certainly have cross-realm trust between
Windows and non-Windows realms and you can also have non-Windows systems
joined to a Windows realm. On the Windows systems, this uses SSPI, and
on the non-Windows systems it uses GSSAPI, but the two are compatible
and will work with each other just fine for authentication.
> An automatic creation of PostgreSQL roles from AD accounts has to be done
> outside PostgreSQL, i. e. by a script running regularly.
This is accurate, thoguh there are tools out there to do this for you,
such as: https://github.com/larskanis/pg-ldap-sync
Thanks,
Stephen
Attachments:
[application/pgp-signature] signature.asc (832B, ../ZdeI+DoZ97jRUXv%2F@tamriel.snowman.net/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, holger@jakobs.com, pgsql-admin@lists.postgresql.org
Subject: Re: Use AD-account as login into Postgres.
In-Reply-To: <ZdeI+DoZ97jRUXv/@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox