From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jacob Champion <jacob.champion@enterprisedb.com>
cc: Chris Gooch <cgooch@bamfunds.com>, pgsql-bugs@lists.postgresql.org
Subject: Re: GSS Auth issue when user member of lots of AD groups
In-reply-to: 
 <CAOYmi+mPdZwNe16yozk40G8hW3d1Rxnoipu0dw52AiuZRoabaA@mail.gmail.com>
References: 
 <DS0PR22MB5971A9C8A3F44BCC6293C4DABE99A@DS0PR22MB5971.namprd22.prod.outlook.com>
 <1529314.1747928806@sss.pgh.pa.us>
 <CAOYmi+nZpOu_Yd_dvQQehK78B48MB-TT1Z7Myp1xSQ1uUHHZVQ@mail.gmail.com>
 <1536692.1747933034@sss.pgh.pa.us>
 <CAOYmi+mPdZwNe16yozk40G8hW3d1Rxnoipu0dw52AiuZRoabaA@mail.gmail.com>
Comments: In-reply-to Jacob Champion <jacob.champion@enterprisedb.com>
	message dated "Thu, 22 May 2025 10:11:53 -0700"
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-ID: <1647589.1747936713.1@sss.pgh.pa.us>
Content-Transfer-Encoding: 8bit
Date: Thu, 22 May 2025 13:58:33 -0400
Message-ID: <1647590.1747936713@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1647590.1747936713%40sss.pgh.pa.us>
Precedence: bulk

Jacob Champion <jacob.champion@enterprisedb.com> writes:
> On Thu, May 22, 2025 at 9:57 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> I'm wondering though if this isn't just pushing the problem out a
>> little further.  Is there a good reason to think 64K is enough?

> Microsoft docs [1] seem to imply that there are still a bunch of
> existing problems if you try to go much higher, though it is possible
> to do so with registry tweaks. Looks like they default to 48k.

> Maybe we should consider making the max incoming ticket size
> configurable, so users that really need a bigger one can deal with the
> DoS risk without it affecting everyone else. (A limit on outgoing
> tickets probably doesn't make too much sense; I imagine you're going
> to use the ticket that GSSAPI hands you, no matter how big it is,
> because it's not as if you have a choice.)

Yeah, but we don't want to change the packet size used after the
initial exchange, because that would create compatibility issues
in cases that aren't failing today.  I didn't look at the code
to see if we can easily use a different buffer size during
the authentication exchange.  If we can, I'd be inclined to goose
it up to 128K or so.  Given Chris' point that should be plenty,
so I don't feel a need to expose a knob.

			regards, tom lane