pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Chris Gooch <cgooch@bamfunds.com>
Cc: Jacob Champion <jacob.champion@enterprisedb.com>
Cc: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Subject: Re: [EXT] Re: GSS Auth issue when user member of lots of AD groups
Date: Fri, 30 May 2025 12:59:58 -0400
Message-ID: <2356943.1748624398@sss.pgh.pa.us> (raw)
In-Reply-To: <DS0PR22MB59711694477CFE09BA3A07DABE61A@DS0PR22MB5971.namprd22.prod.outlook.com>
References: <DS0PR22MB5971A9C8A3F44BCC6293C4DABE99A@DS0PR22MB5971.namprd22.prod.outlook.com>
	<1529314.1747928806@sss.pgh.pa.us>
	<CAOYmi+nZpOu_Yd_dvQQehK78B48MB-TT1Z7Myp1xSQ1uUHHZVQ@mail.gmail.com>
	<1536692.1747933034@sss.pgh.pa.us>
	<CAOYmi+mPdZwNe16yozk40G8hW3d1Rxnoipu0dw52AiuZRoabaA@mail.gmail.com>
	<1647590.1747936713@sss.pgh.pa.us>
	<DS0PR22MB597134B3D28AC101C8936007BE9BA@DS0PR22MB5971.namprd22.prod.outlook.com>
	<3060113.1748096813@sss.pgh.pa.us>
	<3125813.1748115425@sss.pgh.pa.us>
	<CAOYmi+n0RW6uDOpz8sgLHoc0gZB+uTPERoCoP1xM3Szpajsi3w@mail.gmail.com>
	<1350781.1748384129@sss.pgh.pa.us>
	<CAOYmi+kFc_STQC=9kPufkxmUS1RwRSim2p+1MambGJNSHUj-Tg@mail.gmail.com>
	<2089825.1748542158@sss.pgh.pa.us>
	<CAOYmi+krJT8jj=m2hrTaKzgpeB3bvfVQYZ+3x9sOB6Vtyfm1jw@mail.gmail.com>
	<2093402.1748544111@sss.pgh.pa.us>
	<CAOYmi+n9OFW6rHmk37WqsRMTjocYDRU1s5Gzq0kQa3O3LcnTJg@mail.gmail.com>
	<DS0PR22MB59711694477CFE09BA3A07DABE61A@DS0PR22MB5971.namprd22.prod.outlook.com>

Chris Gooch <cgooch@bamfunds.com> writes:
> In that scenario the client did not get any GSSAPI specific errors and drops to prompt for password. The server however had this in the logs "oversize GSSAPI packet sent by the client (20131 > 16384)"

Yeah, that's expected.  By default, a GSSAPI-enabled libpq will try to
open a GSSAPI connection first, but silently fall back to not-GSSAPI
if the server rejects it --- there's not any close inquiry into why
the server rejected it.

Jacob Champion <jacob.champion@enterprisedb.com> writes:
> Okay, on closer review this LGTM.

Pushed, thanks for reviewing.

> I was trying to get src/test/kerberos to shove a bunch of
> authorization data into its tickets, but I haven't figured out how
> to get krb5kdc to do that yet, so Chris's tests are the best we have
> at the moment. Eventually I'll get around to reading the ASN.1 so
> that pg-pytest can test this case, but that's not a job for today.

Sounds reasonable.  I think Chris' testing is good enough for now.
The one thing I was slightly concerned about was whether any data
could remain in the buffers at the instant we downsize them, but
that seems improbable (and it wouldn't depend on the ticket size
anyway, I should think).

			regards, tom lane





view thread (27+ messages)

Message-ID: <2356943.1748624398@sss.pgh.pa.us>
Permalink:  ../2356943.1748624398@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/2356943.1748624398@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: tgl@sss.pgh.pa.us, cgooch@bamfunds.com, jacob.champion@enterprisedb.com, pgsql-bugs@lists.postgresql.org
  Subject: Re: [EXT] Re: GSS Auth issue when user member of lots of AD groups
  In-Reply-To: <2356943.1748624398@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox