Date: Mon, 26 Feb 2024 13:05:56 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Gabriel Guillem =?iso-8859-1?Q?Barcel=F3?= Soteras
 <gbarcelo@parlamentib.es>
Cc: Holger Jakobs <holger@jakobs.com>,
	"pgsql-admin@lists.postgresql.org" <pgsql-admin@lists.postgresql.org>
Subject: Re: Use AD-account as login into Postgres.
Message-ID: <ZdzTBPiWwN8cYSgG@tamriel.snowman.net>
References: 
 <GV1P189MB2132400900DA53D139B09DAFA24B2@GV1P189MB2132.EURP189.PROD.OUTLOOK.COM>
 <09c4b7dc-901d-135e-087b-808c489e0d81@jakobs.com>
 <ZdeI+DoZ97jRUXv/@tamriel.snowman.net>
 <DU0PR08MB7921207CB5A0CF43B81145A1A6552@DU0PR08MB7921.eurprd08.prod.outlook.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="K9eQ3+GEY7wRL4Dn"
Content-Disposition: inline
In-Reply-To: 
 <DU0PR08MB7921207CB5A0CF43B81145A1A6552@DU0PR08MB7921.eurprd08.prod.outlook.com>
User-Agent: Mutt/2.1.4 (2021-12-11)
Archived-At: 
 <https://www.postgresql.org/message-id/ZdzTBPiWwN8cYSgG%40tamriel.snowman.net>
Precedence: bulk


--K9eQ3+GEY7wRL4Dn
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

We prefer that you don't top-post on the PG mailing lists, thanks.

* Gabriel Guillem Barcel=F3 Soteras (gbarcelo@parlamentib.es) wrote:
> Still, in Windows environments, PostgreSQL uses a separated keytab in fil=
esystem.
> This is *nix-fashioned way to give an identity to the process.
>=20
> Windows native way would be service with MSA/gMSA identoty configured (or=
 computter account i.e. NETWORK SERVICE) , but I think that is not possible=
=2E..

There's a detailed explanation of how to do this here:

https://www.crunchydata.com/blog/windows-active-directory-postgresql-gssapi=
-kerberos-authentication

> pg_hba.conf
> hostgssenc all pg_user@dom.internal<mailto:pg_user@dom.internal> 10.20.20=
0.0/16 gss include_realm=3D1 krb_realm=3DDOM.INTERNAL
> Then, on postgres.conf (*NIX or Windows)

This might be what is tripping you up- we don't yet support
GSSAPI/Kerberos encrypted connections when using SSPI (which is what
you're using on Windows).  I hope to propose a patch to implement that
but it's not yet in PG.

Try instead:

host all all 10.20.200.0/16 gss include_realm=3D1 krb_realm=3DDOM.INTERNAL

> Note that I have not touched pg_ident.conf, and created a login instead...

Yes, you'll need to create the user in PostgreSQL.

Thanks,

Stephen

--K9eQ3+GEY7wRL4Dn
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEwf6gbxKhD863zrx/7WyKOINHZFUFAmXc0wIACgkQ7WyKOINH
ZFW78BAAt/kWjV+egdiw+Vcf6pi755fMB8tUlJfSvtRUmprqhh9HpCnKgkIgg4bZ
goYf2IUnFpVXjgdj6/xqR2j2rwYKUJzEaGfYnxgf9dyTRnHYy6K2sTDFuNt/u2Js
CJ9aAY0DFrTno5ojlVVcV1PQUckhO4WqxmLUTVV6OymDhtF0xZkBL2GFZ/zDcz/n
WbAD623eYPyKkQokIocvI2VRiE+AgyxAFbOkHnKL9k1M2dtzlqp0xDSq/1C3fM3B
wlZJ92iCq6o79JVs4wApfRvhQnDgpuljBTZEkFN5IHt3r5yDOOX5zbrfM8YzzMc3
1Rry+O78J9QekdBQtNHkkMOdfr9GFM8qfYlMV/SCbdV719xzwqzJdQhLbq2NhcuZ
66jJ5/8j9VRathbq+Lgg1EFeQHO98SxZ0Kauj5VKs3LmMQjZ6TMx4KTC797bRaIu
dVlHYWXSZIKX0cBSSS/MGXl9/J2Q2x5l8g4eccFRQnnGPE4gZZK9bDeh0a5Ypdqf
05bTzQVUqiS8/vzt/ADAQiUM7Wj9sS09372PScrzq6RP6xXCLCOnVKGMVLDsVvM+
6jgbiW+Qic1e7GNSwAGSCy4070judcObGX3hUJsXTiscfK5oqZn0b+v3SBUMJ5hV
hZpmEuUn3xUYOi9sGlN7V2iXSmy5c7/HWRd17vxJRu0Ul9rIZgY=
=c59w
-----END PGP SIGNATURE-----

--K9eQ3+GEY7wRL4Dn--