From: Tom Lane <tgl@sss.pgh.pa.us>
To: Chris Gooch <cgooch@bamfunds.com>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: GSS Auth issue when user member of lots of AD groups
Date: Thu, 22 May 2025 11:46:46 -0400
Message-ID: <1529314.1747928806@sss.pgh.pa.us> (raw)
In-Reply-To: <DS0PR22MB5971A9C8A3F44BCC6293C4DABE99A@DS0PR22MB5971.namprd22.prod.outlook.com>
References: <DS0PR22MB5971A9C8A3F44BCC6293C4DABE99A@DS0PR22MB5971.namprd22.prod.outlook.com>
[ pgsql-committers is completely inappropriate, redirecting to -bugs ]
Chris Gooch <cgooch@bamfunds.com> writes:
> GSS authentication is working for users with small number of AD
> groups but getting below error when a user has larger number of
> groups. I believe it might to token size related, but they don't
> have issues when authenticating with Kerberos/GSS to other
> applications, only with Postgres.
> failed: GSSAPI context establishment error: The routine must be called again to complete its function: Unknown error
Hmm. That must be coming from this bit in libpq:
/* Must have output.length > 0 */
if (output.length > PQ_GSS_SEND_BUFFER_SIZE - sizeof(uint32))
{
pg_GSS_error(libpq_gettext("GSSAPI context establishment error"),
conn, major, minor);
gss_release_buffer(&minor, &output);
return PGRES_POLLING_FAILED;
}
which makes it look like gss_init_sec_context wants us to send a
packet larger than PQ_GSS_SEND_BUFFER_SIZE, which perhaps is a
plausible thing to happen if the user belongs to enough groups.
Unfortunately, elsewhere in the same file:
* NOTE: The client and server have to agree on the max packet size,
* because we have to pass an entire packet to GSSAPI at a time and we
* don't want the other side to send arbitrarily huge packets as we
* would have to allocate memory for them to then pass them to GSSAPI.
*
* Therefore, these two #define's are effectively part of the protocol
* spec and can't ever be changed.
*/
#define PQ_GSS_SEND_BUFFER_SIZE 16384
#define PQ_GSS_RECV_BUFFER_SIZE 16384
Not sure where to go from here. Unfortunately the person who
was mostly responsible for this code has left the project...
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, cgooch@bamfunds.com, pgsql-bugs@lists.postgresql.org
Subject: Re: GSS Auth issue when user member of lots of AD groups
In-Reply-To: <1529314.1747928806@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox