From: Tom Lane <tgl@sss.pgh.pa.us>
To: Zechman, Derek S <Derek.S.Zechman@snapon.com>
Cc: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Subject: Re: pg_hba.conf "authentication file token too long, skipping"
Date: Mon, 24 Jul 2023 12:51:35 -0400
Message-ID: <1567990.1690217495@sss.pgh.pa.us> (raw)
In-Reply-To: <PH0PR04MB8294A4C5A65D9D492CBBD349C002A@PH0PR04MB8294.namprd04.prod.outlook.com>
References: <PH0PR04MB8294A4C5A65D9D492CBBD349C002A@PH0PR04MB8294.namprd04.prod.outlook.com>
"Zechman, Derek S" <Derek.S.Zechman@snapon.com> writes:
> hostssl all +fnc_personal_account_rl XXX.XX.X.X/16 ldap ldapserver=xxxx-xxxx-xx-xx.mydomainname.com ldapbasedn="OU=Users,OU=Primary,OU=All,DC=mydomainname,DC=com" ldapbinddn="CN=abc_postgres_sa,OU=T1-ServiceAccounts,OU=Tier1,OU=Admin,OU=All,DC=mydomainname,DC=com" ldapbindpasswd="30characterpassword" ldapsearchfilter="(&(objectClass=user)(sAMAccountName=$username)(|(memberof=CN=xxx,OU=Groups,OU=Primary,OU=All,DC=mydomainname,DC=com)(memberof=CN=XxxxxxXXXx,OU=Groups,OU=Primary,OU=All,DC=mydomainname,DC=com)(memberof=CN=xxxxxxxxxxxxxx,OU=Groups,OU=Primary,OU=All,DC=mydomainname,DC=com)))"
Yeah, your ldapsearchfilter option is hitting the 256-byte MAX_TOKEN
limit in hba.c. A one-line improvement would be to increase that
constant, but it doesn't look very much harder to get rid of that
fixed-size buffer altogether in favor of a StringInfo.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, Derek.S.Zechman@snapon.com, pgsql-bugs@lists.postgresql.org
Subject: Re: pg_hba.conf "authentication file token too long, skipping"
In-Reply-To: <1567990.1690217495@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox