Date: Thu, 22 Feb 2024 12:48:40 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Holger Jakobs <holger@jakobs.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: Use AD-account as login into Postgres.
Message-ID: <ZdeI+DoZ97jRUXv/@tamriel.snowman.net>
References: 
 <GV1P189MB2132400900DA53D139B09DAFA24B2@GV1P189MB2132.EURP189.PROD.OUTLOOK.COM>
 <09c4b7dc-901d-135e-087b-808c489e0d81@jakobs.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="Pq6hiDW8qmHE3sUO"
Content-Disposition: inline
In-Reply-To: <09c4b7dc-901d-135e-087b-808c489e0d81@jakobs.com>
User-Agent: Mutt/2.1.4 (2021-12-11)
Archived-At: 
 <https://www.postgresql.org/message-id/ZdeI%2BDoZ97jRUXv/%40tamriel.snowman.net>
Precedence: bulk


--Pq6hiDW8qmHE3sUO
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Greetings,

* Holger Jakobs (holger@jakobs.com) wrote:
> SSPI using AD accounts for authentication works only in a complete Windows
> environment. The client and the server machine have to be member of the same
> AD environment, which isn't possible for non-Windows machines. Otherwise,
> there is no trust between the machines.

This isn't accurate- you can certainly have cross-realm trust between
Windows and non-Windows realms and you can also have non-Windows systems
joined to a Windows realm.  On the Windows systems, this uses SSPI, and
on the non-Windows systems it uses GSSAPI, but the two are compatible
and will work with each other just fine for authentication.

> An automatic creation of PostgreSQL roles from AD accounts has to be done
> outside PostgreSQL, i. e. by a script running regularly.

This is accurate, thoguh there are tools out there to do this for you,
such as: https://github.com/larskanis/pg-ldap-sync

Thanks,

Stephen

--Pq6hiDW8qmHE3sUO
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEwf6gbxKhD863zrx/7WyKOINHZFUFAmXXiPYACgkQ7WyKOINH
ZFUjLBAArc9GLG8k0dyVCMD99qwzF759inU+VdB+aPGJj+s4cJ5ilDXJd9G8Z0yt
EYAPWgR1467xzVHWayHbeehfLvfDJwtGu3KZSeKNW/7gOsJPRbbkIWd4uciE6MwD
r+nHTJwqaEQKyunHq7YKhT+gVbA/87U5VF88T3QoVEU0/6s2+48IXqbwWJuD9MRj
sdYpT0qinAMeYnFPaGpTKphrQqmrV/eTfCsul+ESaxY2zHrDxAzOQjkVYodDVQIR
lr9zJkoxDWvt2u9wSOD9OtmPqNrPzwY0XhxfwJw4IuoBSEXFf0Vm8qnUYHC0G8Ns
K8kbVUKPEzOCHK1WGpC56sDtUaZTuyH6R+sEXqsbM1+gvwLRI1pSy7C7pNbNINEw
XupWD0fJ1wnghyaQlcu2D79sMTXi9g/SID/dHnn6K+7VO3FgebDpM0JnGEMx+9Mt
kDYcmzSp7HmltXC5qM0h5gLf7kI+eonjNBg0Lq2BScWgNiYfpWtZlhDtTRmT/ni9
Kt/hxij8562iAtALzBqz+6W5LIsFudwe+daizKfKE6peNjkFQRdTRffSZIXfQh32
Ygc1aestwN0ZEu8URAwHTpRA7YbgzrUaq1xs12mdJ6zvb7xN4sjNGKEkwyHwLI47
JZ5zCND0ZaXa5t7decgfPeF/PTSj2lxwj5vt+y7Isi/xsFYwU2g=
=x0UH
-----END PGP SIGNATURE-----

--Pq6hiDW8qmHE3sUO--