From: Stephen Frost <sfrost@snowman.net>
To: Gabriel Guillem Barceló Soteras <gbarcelo@parlamentib.es>
Cc: Holger Jakobs <holger@jakobs.com>
Cc: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Subject: Re: Use AD-account as login into Postgres.
Date: Mon, 26 Feb 2024 13:05:56 -0500
Message-ID: <ZdzTBPiWwN8cYSgG@tamriel.snowman.net> (raw)
In-Reply-To: <DU0PR08MB7921207CB5A0CF43B81145A1A6552@DU0PR08MB7921.eurprd08.prod.outlook.com>
References: <GV1P189MB2132400900DA53D139B09DAFA24B2@GV1P189MB2132.EURP189.PROD.OUTLOOK.COM>
<09c4b7dc-901d-135e-087b-808c489e0d81@jakobs.com>
<ZdeI+DoZ97jRUXv/@tamriel.snowman.net>
<DU0PR08MB7921207CB5A0CF43B81145A1A6552@DU0PR08MB7921.eurprd08.prod.outlook.com>
Greetings,
We prefer that you don't top-post on the PG mailing lists, thanks.
* Gabriel Guillem Barceló Soteras (gbarcelo@parlamentib.es) wrote:
> Still, in Windows environments, PostgreSQL uses a separated keytab in filesystem.
> This is *nix-fashioned way to give an identity to the process.
>
> Windows native way would be service with MSA/gMSA identoty configured (or computter account i.e. NETWORK SERVICE) , but I think that is not possible...
There's a detailed explanation of how to do this here:
https://www.crunchydata.com/blog/windows-active-directory-postgresql-gssapi-kerberos-authentication> pg_hba.conf
> hostgssenc all pg_user@dom.internal<mailto:pg_user@dom.internal> 10.20.200.0/16 gss include_realm=1 krb_realm=DOM.INTERNAL
> Then, on postgres.conf (*NIX or Windows)
This might be what is tripping you up- we don't yet support
GSSAPI/Kerberos encrypted connections when using SSPI (which is what
you're using on Windows). I hope to propose a patch to implement that
but it's not yet in PG.
Try instead:
host all all 10.20.200.0/16 gss include_realm=1 krb_realm=DOM.INTERNAL
> Note that I have not touched pg_ident.conf, and created a login instead...
Yes, you'll need to create the user in PostgreSQL.
Thanks,
Stephen
Attachments:
[application/pgp-signature] signature.asc (832B, ../ZdzTBPiWwN8cYSgG@tamriel.snowman.net/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, gbarcelo@parlamentib.es, holger@jakobs.com, pgsql-admin@lists.postgresql.org
Subject: Re: Use AD-account as login into Postgres.
In-Reply-To: <ZdzTBPiWwN8cYSgG@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox