From: Nico Williams <nico@cryptonector.com>
To: Chris Gooch <cgooch@bamfunds.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jacob Champion <jacob.champion@enterprisedb.com>
Cc: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Subject: Re: [EXT] Re: GSS Auth issue when user member of lots of AD groups
Date: Sat, 24 May 2025 18:42:16 -0500
Message-ID: <aDJZWBZZc25xBDX9@ubby> (raw)
In-Reply-To: <DS0PR22MB59712B2BCB379739D97CBA06BE99A@DS0PR22MB5971.namprd22.prod.outlook.com>
References: <DS0PR22MB5971A9C8A3F44BCC6293C4DABE99A@DS0PR22MB5971.namprd22.prod.outlook.com>
<1529314.1747928806@sss.pgh.pa.us>
<CAOYmi+nZpOu_Yd_dvQQehK78B48MB-TT1Z7Myp1xSQ1uUHHZVQ@mail.gmail.com>
<1536692.1747933034@sss.pgh.pa.us>
<DS0PR22MB59712B2BCB379739D97CBA06BE99A@DS0PR22MB5971.namprd22.prod.outlook.com>
On Thu, May 22, 2025 at 05:04:32PM +0000, Chris Gooch wrote:
> It now makes sense to me. I believe the KDC will not allow tokens
> larger than 65535 bytes, so feel it is safe from a GSS perspective.
The KDC protocol over TCP uses 32-bit unsigned PDU lengths in network
byte order, of which the high bit is reserved and must be zero. ASN.1
supports much larger lengths still. The protocol easily supports very
large tickets, therefore very large initial security context tokens.
The architecture of having the user's SIDs be included in the user's
service tickets was very useful as an optimization for a long time, but
as the number of SIDs increases this optimization becomes more of an
albatross.
Nico
--
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: nico@cryptonector.com, cgooch@bamfunds.com, tgl@sss.pgh.pa.us, jacob.champion@enterprisedb.com, pgsql-bugs@lists.postgresql.org
Subject: Re: [EXT] Re: GSS Auth issue when user member of lots of AD groups
In-Reply-To: <aDJZWBZZc25xBDX9@ubby>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox