From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: gopi.anbumech@gmail.com
Subject: BUG #17740: Connecting postgresql 13 with different psql versions
Date: Mon, 09 Jan 2023 08:25:45 +0000
Message-ID: <17740-f9e629897b58b2c3@postgresql.org> (raw)
The following bug has been logged on the website:
Bug reference: 17740
Logged by: Anbu
Email address: gopi.anbumech@gmail.com
PostgreSQL version: 13.8
Operating system: linux
Description:
For GSSAPI Kerberos external authenticated connections, it appears that psql
v13 is not honouring order of the rules specified in pg_hba.conf. Will there
be any difference in way/options with which psql binary has been built ?
With following entries in pg_hba.conf, psql v13 is prompting for password
for Kerberos connections, whereas psql v11 succeeds connecting without any
issue.
local all pgbkp peer map=pgbackrest
hostssl all +citi_pg_app_read 0.0.0.0/0 gss map=krb
host all all 0.0.0.0/0 scram-sha-256
[kdc_test_fid@icl-actpsql-vm1 /psql13]$ psql -U app_kdc_test_fid -h x.x.x -d
postgres -p 1524
Password for user app_kdc_test_fid:
[kdc_test_fid@icl-actpsql-vm1 /psql11]$ psql -U app_kdc_test_fid -h x.x.x -d
postgres -p 1524
psql (11.13, server 13.8)
WARNING: psql major version 11, server major version 13.
Some psql features might not work.
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384,
bits: 256, compression: off)
Type "help" for help.
postgres=>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
But as soon as the this line is commented out in pg_hba.conf, GSSAPI
Kerberos external authenticated connection succeeds for both psql V13 and
v11.
#host all all 0.0.0.0/0 scram-sha-256
[kdc_test_fid@icl-actpsql-vm1 /psql13]$ psql -U app_kdc_test_fid -h x.x.x -d
postgres -p 1524
psql (13.8)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits:
256, compression: off)
Type "help" for help.
postgres=>
[kdc_test_fid@icl-actpsql-vm1 /psql11]$ psql -U app_kdc_test_fid -h x.x.x -d
postgres -p 1524
psql (11.13, server 13.8)
WARNING: psql major version 11, server major version 13.
Some psql features might not work.
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384,
bits: 256, compression: off)
Type "help" for help.
postgres=>
Note: app_kdc_test_fid user is part of defined group in hba rules.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: noreply@postgresql.org, pgsql-bugs@lists.postgresql.org, gopi.anbumech@gmail.com
Subject: Re: BUG #17740: Connecting postgresql 13 with different psql versions
In-Reply-To: <17740-f9e629897b58b2c3@postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox