From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jacob Champion <jacob.champion@enterprisedb.com>
cc: Chris Gooch <cgooch@bamfunds.com>, pgsql-bugs@lists.postgresql.org
Subject: Re: GSS Auth issue when user member of lots of AD groups
In-reply-to: 
 <CAOYmi+nZpOu_Yd_dvQQehK78B48MB-TT1Z7Myp1xSQ1uUHHZVQ@mail.gmail.com>
References: 
 <DS0PR22MB5971A9C8A3F44BCC6293C4DABE99A@DS0PR22MB5971.namprd22.prod.outlook.com>
 <1529314.1747928806@sss.pgh.pa.us>
 <CAOYmi+nZpOu_Yd_dvQQehK78B48MB-TT1Z7Myp1xSQ1uUHHZVQ@mail.gmail.com>
Comments: In-reply-to Jacob Champion <jacob.champion@enterprisedb.com>
	message dated "Thu, 22 May 2025 09:19:14 -0700"
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-ID: <1536691.1747933034.1@sss.pgh.pa.us>
Content-Transfer-Encoding: 8bit
Date: Thu, 22 May 2025 12:57:14 -0400
Message-ID: <1536692.1747933034@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1536692.1747933034%40sss.pgh.pa.us>
Precedence: bulk

Jacob Champion <jacob.champion@enterprisedb.com> writes:
> On Thu, May 22, 2025 at 8:46 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> Hmm.  That must be coming from this bit in libpq:
>> ...
>> which makes it look like gss_init_sec_context wants us to send a
>> packet larger than PQ_GSS_SEND_BUFFER_SIZE, which perhaps is a
>> plausible thing to happen if the user belongs to enough groups.

> Yeah, it seems like we need to be able to handle up to
> PG_MAX_AUTH_TOKEN_LENGTH (64k) for that initial ticket, at least?

Hmm, unfortunate that that was chosen independent of the GSS limits.

> But also, the current behavior is just to fail hard, so if the client
> tries to do something extra that also sometimes fails hard, it may not
> really be a regression...

Yeah, that's a good point.  If we simply allowed the initial packet
to be bigger, that would extend the set of cases that work, and if the
recipient complains (because it predates that change) then it's a case
that would have failed anyway, so we've not made anybody's life worse.

I'm wondering though if this isn't just pushing the problem out a
little further.  Is there a good reason to think 64K is enough?

			regards, tom lane