From: PG Doc comments form <noreply@postgresql.org>
To: pgsql-docs@lists.postgresql.org
Cc: tpo_deb@sourcepole.ch
Subject: Make SSPI documentation clearer
Date: Fri, 10 Mar 2023 15:30:25 +0000
Message-ID: <167846222574.1803490.15815104179136215862@wrigleys.postgresql.org> (raw)
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/15/sspi-auth.html
Description:
The [current SSPI
documentation](https://www.postgresql.org/docs/current/sspi-auth.html)
reads:
"SSPI authentication only works when both server and client are running
Windows, or, on non-Windows platforms, when GSSAPI is available."
I interpret that phrase like this:
* there's a case where both server and client are running Windows
* there's a case where both are running non-Windows
What about mixed cases? When the client is non-Windows, then can it use
SSPI? No, AFAIK not. So I'd suggest to make that phrase above clearer and
completely explicit:
"SSPI authentication works when both server and client are running
Windows.
When the server is on a non-Windows platform then the server must use GSSAPI
if it wants to authenticate the client either via Kerberos or via Active
Directory. A client on a Windows platform that connects to a non-Windows
Postgresql server can either use SSPI (strongly encouraged) or GSS (much
more difficult to set up) if it wants to authenticate via Kerberos or Active
Directory. A client from a non-Windows platform must use GSS if it wants to
authenticate via Kerberos or Active Directory."
Thanks a lot for everything Postgres to you who is reading a considering
this change!
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: noreply@postgresql.org, pgsql-docs@lists.postgresql.org, tpo_deb@sourcepole.ch
Subject: Re: Make SSPI documentation clearer
In-Reply-To: <167846222574.1803490.15815104179136215862@wrigleys.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox