Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1ZA3Zp-0006gX-23 for pgsql-admin@arkaria.postgresql.org; Tue, 30 Jun 2015 22:00:25 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84) (envelope-from ) id 1ZA3Zo-00063I-7v for pgsql-admin@arkaria.postgresql.org; Tue, 30 Jun 2015 22:00:24 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84) (envelope-from ) id 1ZA3Wh-0002q2-31 for pgsql-admin@postgresql.org; Tue, 30 Jun 2015 21:57:11 +0000 Received: from mail-bn1on0059.outbound.protection.outlook.com ([157.56.110.59] helo=na01-bn1-obe.outbound.protection.outlook.com) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84) (envelope-from ) id 1ZA3WZ-0005Kk-Ad for pgsql-admin@postgresql.org; Tue, 30 Jun 2015 21:57:09 +0000 Received: from BY1PR11MB0390.namprd11.prod.outlook.com (10.162.146.14) by BY1PR11MB0392.namprd11.prod.outlook.com (10.162.146.141) with Microsoft SMTP Server (TLS) id 15.1.201.16; Tue, 30 Jun 2015 21:56:55 +0000 Received: from BY1PR11MB0390.namprd11.prod.outlook.com ([10.162.146.14]) by BY1PR11MB0390.namprd11.prod.outlook.com ([10.162.146.14]) with mapi id 15.01.0201.000; Tue, 30 Jun 2015 21:56:55 +0000 From: Scott Whitney To: xujian , "pgsql-admin@postgresql.org" Subject: Re: Postgresql gss user map doesn't work Thread-Topic: [ADMIN] Postgresql gss user map doesn't work Thread-Index: AQHQs1YS+DvtVhRTVkKJRviECEDlMp3Fk2CAgAAFT2I= Date: Tue, 30 Jun 2015 21:56:54 +0000 Message-ID: References: , , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=scott@journyx.com; x-originating-ip: [24.55.4.13] x-microsoft-exchange-diagnostics: 1; BY1PR11MB0392; 5:Ig/dug0T44U82MCRgkdW0SZyuABmpVujE4uxzdLkEArAPy2EEcw9gSu+xW6JPiM7vJyRdo4wZwfZXGuzivlUqQh020BK6Pd5CmJuQP9l82kUWdKXrTB3ArUigTcmhJluKftXz3U5kNZolSDQnIw1/w==; 24:ykPRGuORjf7lmPm/C8+IGmpr96ZkkTqUwcb94sTnndKT04A+Vs4jN6I3/bvS2NC2ZaxvSMfTrbMEOIghuOJpXKkvL4XsXbHBskBSG2k+sc0=; 20:0kI1AfJ99P2LromEPA6B+BgvHFpZlUHOjTnbXpySOPt5j6of9z2kqmLR562spaDgKIwVOEmWEsVjT1vIeDXrgQ== x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BY1PR11MB0392; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(5005006)(3002001); SRVR:BY1PR11MB0392; BCL:0; PCL:0; RULEID:; SRVR:BY1PR11MB0392; x-forefront-prvs: 06237E4555 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(377454003)(51874003)(479174004)(19625215002)(16236675004)(46102003)(95246002)(33646002)(15714825004)(19580395003)(15974865002)(19580405001)(2656002)(99286002)(106116001)(87936001)(5001770100001)(77156002)(62966003)(77096005)(66066001)(76176999)(2501003)(50986999)(54356999)(16234385003)(40100003)(122556002)(86362001)(5001960100002)(107886002)(189998001)(2950100001)(5002640100001)(2900100001)(15975445007)(102836002)(63666004)(92566002)(21314002); DIR:OUT; SFP:1101; SCL:1; SRVR:BY1PR11MB0392; H:BY1PR11MB0390.namprd11.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; received-spf: None (protection.outlook.com: journyx.com does not designate permitted sender hosts) Content-Type: multipart/alternative; boundary="_000_w3sruubpi55plwi55j2qf02i1435701405921emailandroidcom_" MIME-Version: 1.0 X-OriginatorOrg: journyx.com X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jun 2015 21:56:54.9994 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 83db917a-cb55-44ba-82ef-25aa3e32343f X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR11MB0392 X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-admin Precedence: bulk Sender: pgsql-admin-owner@postgresql.org --_000_w3sruubpi55plwi55j2qf02i1435701405921emailandroidcom_ Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 V2VsbCwgdGhhdCdzIGp1c3QgZ29pbmcgdG8gYmUgeW91ciB1bmRlcmx5aW5nIGF1dGhlbnRpY2F0 aW9uIG1ldGhvZC4gU2F5IHlvdSB3YW50IHRvIGF1dGhlbnRpY2F0ZSB2aWEgTERBUCB1c2luZyBB RFMuIFdlbGwsIHlvdSBoYXZlIDIgYmFzaWMgY2hvaWNlLiAiTXkgbmFtZUBteWRvbWFpbi53aGF0 ZXZlci5pbnRlcm5hbC5sb2NhbCIgUHJvYmFibHkgLmxvY2FsLiBZb3UncmUganVzdCBhc2tpbmcg UEcgdG8gYXV0aCBhZ2FpbnN0ICJzb21ldGhpbmcgZWxzZS4iIFlvdSBoYXZlIHRvIGNvbmZpZ3Vy ZSB0aGF0IGluIHRoZSB1bmRlcmx5aW5nIE9TL2RpcmVjdG9yeSBzdG9yZS4NCg0KLS0tLS0tLS0g T3JpZ2luYWwgbWVzc2FnZSAtLS0tLS0tLQ0KRnJvbTogeHVqaWFuIDxqYW1lc3h1QG91dGxvb2su Y29tPg0KRGF0ZTogMDYvMzAvMjAxNSA0OjQwIFBNIChHTVQtMDY6MDApDQpUbzogcGdzcWwtYWRt aW5AcG9zdGdyZXNxbC5vcmcNClN1YmplY3Q6IFJlOiBbQURNSU5dIFBvc3RncmVzcWwgZ3NzIHVz ZXIgbWFwIGRvZXNuJ3Qgd29yaw0KDQppdCBsb29rcyBsaWtlIEkgbmVlZCB0byBzcGVjaWZ5IHRo ZSBtYXBwaW5nIHVzZXIgbmFtZSBpbiB0aGUgY29tbWFuZCwgZm9yIGluc3RhbmNlLCBpZiBteSBj cmVkZW50aWFsIGlzIHh4eCwgSSB3YW50IHRvIGxvZ2luIGFzIHVzZXIgY29tcGFueV9jb21feHh4 LCBJIGhhdmUgdG8gcnVuIGNvbW1hbmQgbGlrZQ0KDQovcHNxbCAtZCBkYm5hbWUgLWggcG9zdGdy ZXNxbC5zZXJ2ZXIubmFtZSAtVSBjb21wYW55X2NvbV94eHgNCg0KYnV0IHdoeSBJIG5lZWQgdG8g c3BlY2lmeSB0aGUgbWFwcGluZyB1c2VyIG5hbWUgY29tcGFueV9jb21feHh4IGluIGNvbW1hbmQg bGluZT8NCmRvZXMgYW55b25lIGhhdmUgc2FtZSBpc3N1ZT8gdGhhbmtzDQoNCkphbWVzDQoNCg0K X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCkZyb206IGphbWVzeHVAb3V0bG9vay5j b20NClRvOiBwZ3NxbC1hZG1pbkBwb3N0Z3Jlc3FsLm9yZw0KU3ViamVjdDogUG9zdGdyZXNxbCBn c3MgdXNlciBtYXAgZG9lc24ndCB3b3JrDQpEYXRlOiBUdWUsIDMwIEp1biAyMDE1IDEyOjU2OjQ3 IC0wNDAwDQoNCkhlbGxvLA0KICAgICAgICBJIGhhdmUgYSBwcm9ibGVtIHdoZW4gSSBhbSB1c2lu ZyBnc3MgbWFwLiBJIHdhbnQgdG8gbWFwIHRoZSB1c2VyIHh4eEBjb21wYW55LmNvbSB0byBkYiBy b2xlIGNvbXBhbnlfY29tX3h4eA0KaGVyZSBpcyBteSBwYV9oYmEuY29uZjoNCj09PT09PT09PT09 PT09PT09DQojIFRZUEUgIERBVEFCQVNFICAgICAgICBVU0VSICAgICAgICAgICAgQUREUkVTUyAg ICAgICAgICAgICAgICAgTUVUSE9EDQpob3N0ICAgICAgYWxsICAgICAgICAgICAgICAgICAgICAg IGFsbCAgICAgICAgICAgICAgICBhbGwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdzcyBp bmNsdWRlX3JlYWxtPTEgbWFwPW15bWFwDQoNCmhlcmUgaXMgdGhlIHBnX2lkZW50LmNvbmYNCj09 PT09PT09PT09PT09PT09DQojIE1BUE5BTUUgICAgICAgU1lTVEVNLVVTRVJOQU1FICAgICAgICAg UEctVVNFUk5BTUUNCm15bWFwICAgICAgICAvKC4qKUBDT01QQU5ZLkNPTSAgICAgICAgICAgICAg Y29tcGFueV9jb21fXDENCg0KSG93ZXZlciwgaXQgZG9lc24ndCB3b3JrLCBJIGdvdCBlcnJvciBt ZXNzYWdlDQo9PT09PT09PT09PT09PT09PQ0KTE9HOiAgbm8gbWF0Y2ggaW4gdXNlcm1hcCAibXlt YXAiIGZvciB1c2VyICJ4eHgiIGF1dGhlbnRpY2F0ZWQgYXMgInh4eEBDT01QQU5ZLkNPTSINCkZB VEFMOiAgR1NTQVBJIGF1dGhlbnRpY2F0aW9uIGZhaWxlZCBmb3IgdXNlciAieHh4Ig0KREVUQUlM OiAgQ29ubmVjdGlvbiBtYXRjaGVkIHBnX2hiYS5jb25mIGxpbmUgODg6ICJob3N0ICAgIGFsbCAg ICAgICAgICAgICBhbGwgICAgICAgYWxsICAgICAgICAgICAgICAgICAgZ3NzIGluY2x1ZGVfcmVh bG09MSBtYXA9bXltYXAiDQoNCg0KYnV0IGlmIEkgY2hhbmdlZCB0aGUgbWFwIHRvDQo9PT09PT09 PT09PT09PT09PQ0KIyBNQVBOQU1FICAgICAgIFNZU1RFTS1VU0VSTkFNRSAgICAgICAgICAgICAg IFBHLVVTRVJOQU1FDQpteW1hcCAgICAgICAgICAgICAgIC8oLiopQENPTVBBTlkuQ09NICAgICAg ICAgICAgICBcMQ0KDQp0aGVuIEkgY2FuIGxvZ2luLCBJIGhhdmUgY3JlYXRlZCByb2xlIHh4eCBh bmQgY29tcGFueV9jb21feHh4IGluIGRiIHNpZGUuIGV2ZW4gaWYgSSBoYXJkIGNvZGUgdGhlIHVz ZXJuYW1lIGluIHRoZSBtYXBwaW5nIGxpa2UNCj09PT09PT09PT09PT09PT09DQojIE1BUE5BTUUg ICAgICAgU1lTVEVNLVVTRVJOQU1FICAgICAgICAgUEctVVNFUk5BTUUNCm15bWFwICAgICAgICAv KC4qKUBDT01QQU5ZLkNPTSAgICAgICAgICAgICAgY29tcGFueV9jb21feHh4DQoNCml0IHN0aWxs IGRvZXNuJ3Qgd29yay4gYW55IGlkZWE/DQoNClRoYW5rcyBpbiBhZHZhbmNlIQ0KDQpKYW1lcw0K DQoNCg0KSm91cm55eCwgSW5jLg0KNzYwMCBCdXJuZXQgUm9hZCAjMzAwDQpBdXN0aW4sIFRYIDc4 NzU3DQp3d3cuam91cm55eC5jb20NCg0KcCA1MTIuODM0Ljg4ODgNCmYgNTEyLTgzNC04ODU4DQoN CkRvIHlvdSByZWNlaXZlIG91ciBwcm9tb3Rpb25hbCBlbWFpbHM/IFlvdSBjYW4gc3Vic2NyaWJl IG9yIHVuc3Vic2NyaWJlIHRvIHRob3NlIGVtYWlscyBhdCBodHRwOi8vZ28uam91cm55eC5jb20v ZW1haWxQcmVmZXJlbmNlL2UvNDkzMi83MTQvDQo= --_000_w3sruubpi55plwi55j2qf02i1435701405921emailandroidcom_ Content-Type: text/html; charset="gb2312" Content-Transfer-Encoding: quoted-printable Well, that's just going to be your underlying authentication method. Say yo= u want to authenticate via LDAP using ADS. Well, you have 2 basic choice. &= quot;My name@mydomain.whatever.internal.local" Probably .local. You're= just asking PG to auth against "something else." You have to configure that in the underlying OS/directory stor= e.

-------- Original message --------
From: xujian <jamesxu@outlook.com>
Date: 06/30/2015 4:40 PM (GMT-06:00)
To: pgsql-admin@postgresql.org
Subject: Re: [ADMIN] Postgresql gss user map doesn't work

it looks like I need to specify the mapping user name in t= he command, for instance, if my credential is xxx, I want to login as user = company_com_xxx, I have to run command like

/psql -d dbname -h postgresql.server.name -U company_com_xxx

but why I need to specify the mapping u= ser name company_com_xxx in comm= and line? 
does anyone have same issue? thanks

James


From: jamesxu@outlook.com
To: pgsql-admin@postgresql.org
Subject: Postgresql gss user map doesn't work
Date: Tue, 30 Jun 2015 12:56:47 -0400

Hello,
        I have a problem when I am using gss map.&= nbsp;I want to map the user xxx@company.com = to db role company_com_xxx
here is my pa_hba.conf:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
# TYPE  DATABASE        USER     &n= bsp;      ADDRESS             =     METHOD
host      all            =          all           &= nbsp;    all               &nb= sp;             gss include_realm=3D1 map=3Dm= ymap

here is the pg_ident.conf
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
# MAPNAME       SYSTEM-USERNAME       &n= bsp; PG-USERNAME
mymap        /(.*)@COMPANY.COM      = ;        company_com_\1

However, it doesn't work, I got error message
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
LOG:  no match in usermap "mymap" for user "xxx&qu= ot; authenticated as "xxx@COMPANY.COM"
FATAL:  GSSAPI authentication failed for user "xxx"
DETAIL:  Connection matched pg_hba.conf line 88: "host  = ;  all             all     &nb= sp; all                  gss i= nclude_realm=3D1 map=3Dmymap"


but if I changed the map to 
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
# MAPNAME       SYSTEM-USERNAME       &n= bsp;       PG-USERNAME
mymap               /(.*)@COMPANY.C= OM              \1

then I can login, I have created role xxx and company_com_xxx in db si= de. even if I hard code the username in the mapping like
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
# MAPNAME       SYSTEM-USERNAME       &n= bsp; PG-USERNAME
mymap        /(.*)@COMPANY.COM      = ;        company_com_xxx

it still doesn't work. any idea? 

Thanks in advance!

James



Journyx, Inc.
7600 Burnet Road #300
Austin, TX 78757
www.journyx.com

p 512.834.8888 
f 512-834-8858 

Do you receive our promotional emails? You can subscribe or unsubscrib= e to those emails at http://go.journyx.com/emailPreference/e/4932/714/ = ;
--_000_w3sruubpi55plwi55j2qf02i1435701405921emailandroidcom_--