From: Tom Lane <tgl@sss.pgh.pa.us>
To: Chris Gooch <cgooch@bamfunds.com>
cc: Jacob Champion <jacob.champion@enterprisedb.com>,
        "pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>
Subject: Re: [EXT] Re: GSS Auth issue when user member of lots of AD groups
In-reply-to: 
 <DS0PR22MB59711694477CFE09BA3A07DABE61A@DS0PR22MB5971.namprd22.prod.outlook.com>
References: 
 <DS0PR22MB5971A9C8A3F44BCC6293C4DABE99A@DS0PR22MB5971.namprd22.prod.outlook.com>
 <1529314.1747928806@sss.pgh.pa.us>
 <CAOYmi+nZpOu_Yd_dvQQehK78B48MB-TT1Z7Myp1xSQ1uUHHZVQ@mail.gmail.com>
 <1536692.1747933034@sss.pgh.pa.us>
 <CAOYmi+mPdZwNe16yozk40G8hW3d1Rxnoipu0dw52AiuZRoabaA@mail.gmail.com>
 <1647590.1747936713@sss.pgh.pa.us>
 <DS0PR22MB597134B3D28AC101C8936007BE9BA@DS0PR22MB5971.namprd22.prod.outlook.com>
 <3060113.1748096813@sss.pgh.pa.us> <3125813.1748115425@sss.pgh.pa.us>
 <CAOYmi+n0RW6uDOpz8sgLHoc0gZB+uTPERoCoP1xM3Szpajsi3w@mail.gmail.com>
 <1350781.1748384129@sss.pgh.pa.us>
 <CAOYmi+kFc_STQC=9kPufkxmUS1RwRSim2p+1MambGJNSHUj-Tg@mail.gmail.com>
 <2089825.1748542158@sss.pgh.pa.us>
 <CAOYmi+krJT8jj=m2hrTaKzgpeB3bvfVQYZ+3x9sOB6Vtyfm1jw@mail.gmail.com>
 <2093402.1748544111@sss.pgh.pa.us>
 <CAOYmi+n9OFW6rHmk37WqsRMTjocYDRU1s5Gzq0kQa3O3LcnTJg@mail.gmail.com>
 <DS0PR22MB59711694477CFE09BA3A07DABE61A@DS0PR22MB5971.namprd22.prod.outlook.com>
Comments: In-reply-to Chris Gooch <cgooch@bamfunds.com>
	message dated "Fri, 30 May 2025 09:27:21 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2356942.1748624398.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Fri, 30 May 2025 12:59:58 -0400
Message-ID: <2356943.1748624398@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/2356943.1748624398%40sss.pgh.pa.us>
Precedence: bulk

Chris Gooch <cgooch@bamfunds.com> writes:
> In that scenario the client did not get any GSSAPI specific errors and d=
rops to prompt for password. The server however had this in the logs "over=
size GSSAPI packet sent by the client (20131 > 16384)"

Yeah, that's expected.  By default, a GSSAPI-enabled libpq will try to
open a GSSAPI connection first, but silently fall back to not-GSSAPI
if the server rejects it --- there's not any close inquiry into why
the server rejected it.

Jacob Champion <jacob.champion@enterprisedb.com> writes:
> Okay, on closer review this LGTM.

Pushed, thanks for reviewing.

> I was trying to get src/test/kerberos to shove a bunch of
> authorization data into its tickets, but I haven't figured out how
> to get krb5kdc to do that yet, so Chris's tests are the best we have
> at the moment. Eventually I'll get around to reading the ASN.1 so
> that pg-pytest can test this case, but that's not a job for today.

Sounds reasonable.  I think Chris' testing is good enough for now.
The one thing I was slightly concerned about was whether any data
could remain in the buffers at the instant we downsize them, but
that seems improbable (and it wouldn't depend on the ticket size
anyway, I should think).

			regards, tom lane