From: Stephen Frost <sfrost@snowman.net>
To: tpo_deb@sourcepole.ch
To: pgsql-docs@lists.postgresql.org
Subject: Re: Make SSPI documentation clearer
Date: Sun, 12 Mar 2023 20:36:53 -0400
Message-ID: <ZA5wJQFOcULuIwwn@tamriel.snowman.net> (raw)
In-Reply-To: <167846222574.1803490.15815104179136215862@wrigleys.postgresql.org>
References: <167846222574.1803490.15815104179136215862@wrigleys.postgresql.org>
Greetings,
* PG Doc comments form (noreply@postgresql.org) wrote:
> Page: https://www.postgresql.org/docs/15/sspi-auth.html
> Description:
>
> The [current SSPI
> documentation](https://www.postgresql.org/docs/current/sspi-auth.html)
> reads:
>
> "SSPI authentication only works when both server and client are running
> Windows, or, on non-Windows platforms, when GSSAPI is available."
>
> I interpret that phrase like this:
>
> * there's a case where both server and client are running Windows
> * there's a case where both are running non-Windows
Yeah, that phrasing isn't great.
> What about mixed cases? When the client is non-Windows, then can it use
> SSPI? No, AFAIK not. So I'd suggest to make that phrase above clearer and
> completely explicit:
SSPI is Windows-specific, yeah.
> "SSPI authentication works when both server and client are running
> Windows.
>
> When the server is on a non-Windows platform then the server must use GSSAPI
> if it wants to authenticate the client either via Kerberos or via Active
> Directory. A client on a Windows platform that connects to a non-Windows
> Postgresql server can either use SSPI (strongly encouraged) or GSS (much
> more difficult to set up) if it wants to authenticate via Kerberos or Active
> Directory. A client from a non-Windows platform must use GSS if it wants to
> authenticate via Kerberos or Active Directory."
Rather than work in negative, I feel like it might make more sense to
work in positives? That is, perhaps this instead:
On Windows platforms, SSPI is the default and most commonly used
mechanism. Note that an SSPI client can authenticate to a server which
is using either SSPI or GSSAPI, and a GSSAPI client can authenticate to
a server which is using either SSPI or GSSAPI. Generally speaking,
clients and servers on Windows are recommended to use SSPI while clients
and servers on Unix (non-Windows) platforms use GSSAPI.
Stricltly speaking, this is all independent of if AD is being used as
the KDC or not.
Thanks,
Stephen
Attachments:
[application/pgp-signature] signature.asc (832B, ../ZA5wJQFOcULuIwwn@tamriel.snowman.net/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: sfrost@snowman.net, tpo_deb@sourcepole.ch, pgsql-docs@lists.postgresql.org
Subject: Re: Make SSPI documentation clearer
In-Reply-To: <ZA5wJQFOcULuIwwn@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox