From: Tom Lane <tgl@sss.pgh.pa.us>
To: "Zechman, Derek S" <Derek.S.Zechman@snapon.com>
cc: "pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>
Subject: Re: pg_hba.conf "authentication file token too long, skipping"
In-reply-to: 
 <PH0PR04MB8294A4C5A65D9D492CBBD349C002A@PH0PR04MB8294.namprd04.prod.outlook.com>
References: 
 <PH0PR04MB8294A4C5A65D9D492CBBD349C002A@PH0PR04MB8294.namprd04.prod.outlook.com>
Comments: In-reply-to "Zechman, Derek S" <Derek.S.Zechman@snapon.com>
	message dated "Mon, 24 Jul 2023 15:05:15 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1567989.1690217495.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 24 Jul 2023 12:51:35 -0400
Message-ID: <1567990.1690217495@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1567990.1690217495%40sss.pgh.pa.us>
Precedence: bulk

"Zechman, Derek S" <Derek.S.Zechman@snapon.com> writes:
> hostssl all +fnc_personal_account_rl XXX.XX.X.X/16 ldap ldapserver=3Dxxx=
x-xxxx-xx-xx.mydomainname.com ldapbasedn=3D"OU=3DUsers,OU=3DPrimary,OU=3DA=
ll,DC=3Dmydomainname,DC=3Dcom" ldapbinddn=3D"CN=3Dabc_postgres_sa,OU=3DT1-=
ServiceAccounts,OU=3DTier1,OU=3DAdmin,OU=3DAll,DC=3Dmydomainname,DC=3Dcom"=
 ldapbindpasswd=3D"30characterpassword" ldapsearchfilter=3D"(&(objectClass=
=3Duser)(sAMAccountName=3D$username)(|(memberof=3DCN=3Dxxx,OU=3DGroups,OU=3D=
Primary,OU=3DAll,DC=3Dmydomainname,DC=3Dcom)(memberof=3DCN=3DXxxxxxXXXx,OU=
=3DGroups,OU=3DPrimary,OU=3DAll,DC=3Dmydomainname,DC=3Dcom)(memberof=3DCN=3D=
xxxxxxxxxxxxxx,OU=3DGroups,OU=3DPrimary,OU=3DAll,DC=3Dmydomainname,DC=3Dco=
m)))"

Yeah, your ldapsearchfilter option is hitting the 256-byte MAX_TOKEN
limit in hba.c.  A one-line improvement would be to increase that
constant, but it doesn't look very much harder to get rid of that
fixed-size buffer altogether in favor of a StringInfo.

			regards, tom lane