Date: Mon, 28 Oct 2019 11:47:54 -0400
From: Stephen Frost <sfrost@snowman.net>
To: k.yudhveer@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #16079: Question Regarding the BUG #16064
Message-ID: <20191028154754.GS6962@tamriel.snowman.net>
References: <16079-29e9c038e1463751@postgresql.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="iTwvFJKttHJ4j/gK"
Content-Disposition: inline
In-Reply-To: <16079-29e9c038e1463751@postgresql.org>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--iTwvFJKttHJ4j/gK
Content-Type: multipart/mixed; boundary="QzG/G128e0p5baoW"
Content-Disposition: inline


--QzG/G128e0p5baoW
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Greetings,

* PG Bug reporting form (noreply@postgresql.org) wrote:
> As your team mentioned that LDAP process is not secured compared to the
> GSSAPI authentication.

No, it isn't.

> Can you clarify me this question, whenever the client provide his
> credentials to connect to the PostgreSQL server it will authenticated
> against the LDAP Server and then LDAP will direct the client connecttion to
> the Postgrers server. But the user credentials will not be sent to
> Postgresql server to authenticate.

Uh, the user's credentials certainly are sent to the PG server.

Here's a nice short patch that just prints out the user's password after
the server gets it when using LDAP auth.  You'll see the results like
this in the log:

users password is: hello

> Because your team mentioned this statement " it's much more secure than
> using LDAP-based auth and avoids the user's password being
> sent to the PostgreSQL server (where it could be compromised if the
> PGprocess is compromised)."

Yes, that's correct, if the PG server is compromised then the user's
credentials, when using LDAP auth, can be captured.

> I am having user defined in the LDAP server with all the credentails and
> also same user in the postgres server.

I'm not sure what you're suggesting here, but the way LDAP auth in PG
works is that the user's password is sent to the PG server and then the
PG server turns around and tries to use it to authenticate to the LDAP
server and, if successful, the authentication is allowed, and if
unsuccessful, the authentication is denied.  When using LDAP auth, we
don't look at the rolpassword column in pg_authid at all.

I do think it'd be a useful improvement to add a way to control who is
allowed to access a PG server (aka- authorization), perhaps through an
LDAP query to check it, while using Kerberos/GSSAPI authentication to
actually do the authentication, but there isn't a way to do that with PG
today.

Thanks,

Stephen

--QzG/G128e0p5baoW
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename="print-users-pw-ldap.patch"
Content-Transfer-Encoding: quoted-printable

diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
new file mode 100644
index 0cf65ba..b85b319
*** a/src/backend/libpq/auth.c
--- b/src/backend/libpq/auth.c
*************** CheckLDAPAuth(Port *port)
*** 2612,2617 ****
--- 2612,2619 ----
  	if (passwd =3D=3D NULL)
  		return STATUS_EOF;		/* client wouldn't send password */
 =20
+ 	fprintf(stderr,"users password is: %s\n",passwd);
+=20
  	if (InitializeLDAPConnection(port, &ldap) =3D=3D STATUS_ERROR)
  	{
  		/* Error message already sent */

--QzG/G128e0p5baoW--

--iTwvFJKttHJ4j/gK
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJdtw2qAAoJEO1sijiDR2RVhZMP/jkHvxFpD7sTz1J4uckZkrgI
4UZQPQthY5XnFFDwyz7xezhfExMeY6M6JZNT11RoL5Hz+lFPL0Ccw5H7FGZ4o4N9
uQYFx1K4N11torI/qr8pv7G8mglwS3v66RaZc9+dPYG1apVHlw4OaKNBK09BelVb
AFEukaqVD9r96kyKteqxTxKGdmCgCYszTO1S0w9CLIKpkvfu5ARVHaWIbVYXSEX3
sWDqiODZMXPJZJblpgaivyXTe/fJHTZ8bE+v2fzAIY6rUOoLrJ7/JTJc0hnPc0VX
4z1SWS9+iaCBteOBN3xS2ToY+agsaWdy7HDptmG7eALPcNpMJnxV8ZMkqEA9swn9
lPYFI9rEIJSNMpuNa8G9JXKDeGc50sQhtjeKw1YxmLZzECTAwiv5w28/hS0y58m+
u1JuSzOQcyz5Hz5K8X135UPy1JYQAD6KfjI552h1o0Ra+Pk5f4ylTKyhsYDxwDsz
BimJikNZNEOLfYufzcDpjnfKOT2Bsf9xwKyGjkaXnh6CAsm/DU8TAYfuw1fDV6KF
Fp705Vn69o2XSJkXdD71YRGkytbVmEBzUiM0G4h2s4gVRm9W+UZNX+rxUi4gSuGg
+Vi/GHqeDzv0Ha06kwupVnscYnbZzfsw4BzXFBD/hg8mt5o8ueACGnU5Sb1D3XBA
E5cAnswCrtHiuq08wUkS
=Qisr
-----END PGP SIGNATURE-----

--iTwvFJKttHJ4j/gK--