From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Anjul Tyagi <anjul@ibosstech-us.com>
To: pgsql-admin <pgsql-admin@postgresql.org>
Subject: Re: LDAP Configuration
Date: Wed, 01 Apr 2020 13:33:04 +0200
Message-ID: <d57dc066aa37cf87be2d0c9936f0d43557ba4be9.camel@cybertec.at> (raw)
In-Reply-To: <em62afb13f-e34b-48c8-8500-7edfd179a57b@iboss01108>
References: <em62afb13f-e34b-48c8-8500-7edfd179a57b@iboss01108>
On Wed, 2020-04-01 at 10:29 +0000, Anjul Tyagi wrote:
> we are implementing the LDAP authentication and we are able to connect with LDAP and able to
> authenticate the user with that. However we have 2 type of users, one - corporate users and
> available of Active Directory and second application user, which is used by different
> application to connect with database.
>
> Below entry i did in the pg_hba.conf file, if i create user in DB (similar exist on AD) it works.
> However if i create one user with password, it calls the LDAP server for authentication
> and fails as it does not exists in AD.
>
> host all all 0.0.0.0/0 ldap ldapserver=<LDAL Server> ldapbasedn="OU=Corporate,DC=etch,dc=com" ldapbinddn="CN=AdSyncAcct,OU=Service Accounts,DC=etch,DC=com"
> ldapbindpasswd="Password" ldapsearchattribute="sAMAccountName"
>
> we are using the postgres 10.10 version.
>
> can you please suggest the pg_hba.conf file entry, that will help us to authenticate the users
> from LDAP and from postgres as well.
Create a NOLOGIN role "ldapusers" in PostgreSQL and assign the users to authenticate
with LDAP to that group.
Then use two lines in pg_hba.conf:
host all +ldapusers 0.0.0.0/0 ldap ...
host all all 0.0.0.0/0 scram-sha-256
All users in the "ldapusers" group will be authenticated with LDAP,
and the others will "fall through" to the password authentication.
Yours,
Laurenz Albe
--
Cybertec | https://www.cybertec-postgresql.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: laurenz.albe@cybertec.at, anjul@ibosstech-us.com
Subject: Re: LDAP Configuration
In-Reply-To: <d57dc066aa37cf87be2d0c9936f0d43557ba4be9.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox