From: Tom Lane <tgl@sss.pgh.pa.us>
To: gopi.anbumech@gmail.com
cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17740: Connecting postgresql 13 with different psql versions
In-reply-to: <17740-f9e629897b58b2c3@postgresql.org>
References: <17740-f9e629897b58b2c3@postgresql.org>
Comments: In-reply-to PG Bug reporting form <noreply@postgresql.org>
	message dated "Mon, 09 Jan 2023 08:25:45 +0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <4092737.1673277565.1@sss.pgh.pa.us>
Date: Mon, 09 Jan 2023 10:19:25 -0500
Message-ID: <4092738.1673277565@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/4092738.1673277565%40sss.pgh.pa.us>
Precedence: bulk

PG Bug reporting form <noreply@postgresql.org> writes:
> With following entries in pg_hba.conf, psql v13 is prompting for password
> for Kerberos connections, whereas psql v11 succeeds connecting without any
> issue.

> local all pgbkp peer map=pgbackrest
> hostssl all +citi_pg_app_read 0.0.0.0/0 gss map=krb
> host all all 0.0.0.0/0 scram-sha-256

> [kdc_test_fid@icl-actpsql-vm1 /psql13]$ psql -U app_kdc_test_fid -h x.x.x -d
> postgres -p 1524
> Password for user app_kdc_test_fid:

I suspect the v13 libpq is trying GSSAPI encryption before SSL encryption,
so it falls through the hostssl line and ends up at the catchall.

			regards, tom lane