Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jJbcP-0008UE-75 for pgsql-admin@arkaria.postgresql.org; Wed, 01 Apr 2020 11:33:13 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1jJbcO-0006km-37 for pgsql-admin@arkaria.postgresql.org; Wed, 01 Apr 2020 11:33:12 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jJbcN-0006i1-Rd for pgsql-admin@lists.postgresql.org; Wed, 01 Apr 2020 11:33:11 +0000 Received: from mail-wm1-x32a.google.com ([2a00:1450:4864:20::32a]) by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1jJbcK-00040I-KG for pgsql-admin@postgresql.org; Wed, 01 Apr 2020 11:33:10 +0000 Received: by mail-wm1-x32a.google.com with SMTP id i19so6794755wmb.0 for ; Wed, 01 Apr 2020 04:33:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybertec-at.20150623.gappssmtp.com; s=20150623; h=message-id:subject:from:to:date:in-reply-to:references:user-agent :mime-version:content-transfer-encoding; bh=n4vueXzF8GcfoKxUfQefLxnQKEQoBXKh9kBC+sJbX9k=; b=I8y7UOs7AzOp8rfdlIEN+x+tSu1j+luUKAcsxQjauic7LauOUt8k+1D/RWrQ9vjgmU ZqKW4/IJoAHe3E1f45A4bazA5+G0DOnF73Ll9qPQa47Dt/8ScoO97iUNrtDktNydD/FN 7HrD4HiJLXK2dY48YFP/QzQmf8VrF4KmV4ZFntTGKqmB74UGqokWGtZKXx5ETMYv26GX v12wHoZOe0E275/czWJn6iZfPEOinI2oK3x92dXNvpiZgtSdRYyeRD7M2FTfeZalOKGw UjE4BhVyHTozBwtbr/VrUxYb6DtEjaRKBHhbHqQ+glj5Qp/Y9Q/Erbijj73FmSJ/M+TE 8VQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:subject:from:to:date:in-reply-to :references:user-agent:mime-version:content-transfer-encoding; bh=n4vueXzF8GcfoKxUfQefLxnQKEQoBXKh9kBC+sJbX9k=; b=USlI0vdgUYQjFXCk58fhenZElmdj83Xl2S1fC8Rh4uE1wjbE9DQ2OEEPbtZF/n50Pi qSPFrwkZGIE5rJbtCPxj2xlUw3Ot7HjoP7IJdAed7pnWMmbpylZ+UtYZ/MPJ+nu5enbX dPriIXmuyGEf0hEa6D4x4HkCoisi6bFtaF/fuN6YYMWS6sCImDO/x39do9B8m5M2scfr vXOSXHNpbaeoCUowvIjCiYmFrUHc8dXhBblKDGytYXWS6clThbqT9WoRzX6mSfXphAfQ 7CEWb65OjqPJ6X5hEm+Ak7g89fNO84ZDKH0FG2y51CLF0wGQ6tKa0ePrtRTRCGfdUwio pQ6A== X-Gm-Message-State: AGi0Pua8v+WKwkU1EiKDLOSxaauRE29eZ2q8o6lOAIWypG1Ws1Arts8a hCUHXav/NKU6UeLabaNnDiYIgd/yPU0= X-Google-Smtp-Source: APiQypJqR9fpM9OAeIorD2GJsMWQ6claPVHOVXrzhcgHTC+EyQl+5SEN1zMXodSkExifetNZZeC1OQ== X-Received: by 2002:a1c:62c5:: with SMTP id w188mr4000149wmb.112.1585740786043; Wed, 01 Apr 2020 04:33:06 -0700 (PDT) Received: from dynamic-eljdt8as3lz0mvv4o-pd01.res.v6.highway.a1.net (dynamic-eljdt8as3lz0mvv4o-pd01.res.v6.highway.a1.net. [2001:871:60:1aac:79bb:d0e4:aaf7:f558]) by smtp.gmail.com with ESMTPSA id b199sm2483097wme.23.2020.04.01.04.33.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 01 Apr 2020 04:33:05 -0700 (PDT) Message-ID: Subject: Re: LDAP Configuration From: Laurenz Albe To: Anjul Tyagi , pgsql-admin Date: Wed, 01 Apr 2020 13:33:04 +0200 In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.32.5 (3.32.5-1.fc30) MIME-Version: 1.0 Content-Transfer-Encoding: 7bit List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk On Wed, 2020-04-01 at 10:29 +0000, Anjul Tyagi wrote: > we are implementing the LDAP authentication and we are able to connect with LDAP and able to > authenticate the user with that. However we have 2 type of users, one - corporate users and > available of Active Directory and second application user, which is used by different > application to connect with database. > > Below entry i did in the pg_hba.conf file, if i create user in DB (similar exist on AD) it works. > However if i create one user with password, it calls the LDAP server for authentication > and fails as it does not exists in AD. > > host all all 0.0.0.0/0 ldap ldapserver= ldapbasedn="OU=Corporate,DC=etch,dc=com" ldapbinddn="CN=AdSyncAcct,OU=Service Accounts,DC=etch,DC=com" > ldapbindpasswd="Password" ldapsearchattribute="sAMAccountName" > > we are using the postgres 10.10 version. > > can you please suggest the pg_hba.conf file entry, that will help us to authenticate the users > from LDAP and from postgres as well. Create a NOLOGIN role "ldapusers" in PostgreSQL and assign the users to authenticate with LDAP to that group. Then use two lines in pg_hba.conf: host all +ldapusers 0.0.0.0/0 ldap ... host all all 0.0.0.0/0 scram-sha-256 All users in the "ldapusers" group will be authenticated with LDAP, and the others will "fall through" to the password authentication. Yours, Laurenz Albe -- Cybertec | https://www.cybertec-postgresql.com