From: Sylvain Deveaux <Sylvain.Deveaux@niwa.co.nz>
To: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Subject: Ldap config for Active Directory
Date: Wed, 14 Sep 2022 23:31:43 +0000
Message-ID: <b41288eedb459fdc31ac2f05cef0401f3d8a73b6.camel@niwa.co.nz> (raw)
Hello community,
I'm using postgreSQL with docker image, most of them are postgres 14+Postgis
We have to use LDAP in our AD environment, Users could use Kerberos but service accounts used by Apps can't.
The problem that I'm facing is our different users are in different OUs, let's say we have two different OUs both at the root path of our AD
AdminOU and UserOU
Here my first working setup:
host all +ldap_roles 192.168.0.0/16 ldap ldapurl="ldap://ldap.service:636/ou=AdminOU,dc=domain,dc=org?sAMAccountName?sub" ldapbinddn="cn=postgres_bind,ou=level1,ou=level2,dc=domain,dc=org" ldapbindpasswd="password"
So all admin users can be 'seen' by postgres, auth is working well.
If I remove the AdminOU : ldapurl="ldap://ldap.service:636/dc=domain,dc=org?sAMAccountName?sub"
Then I got a LdapBind error:
DETAIL: LDAP diagnostics: 000004DC: LdapErr: DSID-0C0907E9, comment: In order to perform this operation a successful bind must be completed on the connection., data 0
, v2580
After multiple try and error I got something that is working, but for me it does have sense why it failed previously.. I had to :
* Change the ldap port, to use the Global Catalog LDAP SSL 3269
* To change the bind user syntax, and use user@domain<mailto:user@domain>
I tried All these options separately and only this combination is working
host all +ldap_roles 192.168.0.0/16 ldap ldapurl="ldap://ldap.service:3269/dc=domain,dc=org?sAMAccountName?sub" ldapbinddn="postgres_bind@domain.org" ldapbindpasswd="password"
Cheers,
Sylvain
[https://www.niwa.co.nz/static/niwa-2018-horizontal-180.png] <https://www.niwa.co.nz;
Sylvain Deveaux
Senior Systems Engineer
+64-4-386-0861
+64-21-123-7933
National Institute of Water & Atmospheric Research Ltd (NIWA)
301 Evans Bay Parade, Greta Point Wellington New Zealand
Connect with NIWA: niwa.co.nz<https://www.niwa.co.nz; Facebook<https://www.facebook.com/nzniwa; LinkedIn<https://www.linkedin.com/company/niwa; Twitter<https://twitter.com/niwa_nz; Instagram<https://www.instagram.com/niwa_science;
To ensure compliance with legal requirements and to maintain cyber security standards, NIWA's IT systems are subject to ongoing monitoring, activity logging and auditing. This monitoring and auditing service may be provided by third parties. Such third parties can access information transmitted to, processed by and stored on NIWA's IT systems
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: Sylvain.Deveaux@niwa.co.nz, pgsql-admin@lists.postgresql.org
Subject: Re: Ldap config for Active Directory
In-Reply-To: <b41288eedb459fdc31ac2f05cef0401f3d8a73b6.camel@niwa.co.nz>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox