Date: Wed, 27 Sep 2023 19:09:02 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: tpo_deb@sourcepole.ch, pgsql-docs@lists.postgresql.org
Subject: Re: Make SSPI documentation clearer
Message-ID: <ZRS2Dpp4mX0plOaN@momjian.us>
References: 
 <167846222574.1803490.15815104179136215862@wrigleys.postgresql.org>
 <ZA5wJQFOcULuIwwn@tamriel.snowman.net>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="Y5H3x42QKFE4NrpI"
Content-Disposition: inline
In-Reply-To: <ZA5wJQFOcULuIwwn@tamriel.snowman.net>
Archived-At: 
 <https://www.postgresql.org/message-id/ZRS2Dpp4mX0plOaN%40momjian.us>
Precedence: bulk


--Y5H3x42QKFE4NrpI
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Sun, Mar 12, 2023 at 08:36:53PM -0400, Stephen Frost wrote:
> > When the server is on a non-Windows platform then the server must use GSSAPI
> > if it wants to authenticate the client either via Kerberos or via Active
> > Directory. A client on a Windows platform that connects to a non-Windows
> > Postgresql server can either use SSPI (strongly encouraged) or GSS (much
> > more difficult to set up) if it wants to authenticate via Kerberos or Active
> > Directory. A client from a non-Windows platform must use GSS if it wants to
> > authenticate via Kerberos or Active Directory."
> 
> Rather than work in negative, I feel like it might make more sense to
> work in positives?  That is, perhaps this instead:
> 
> On Windows platforms, SSPI is the default and most commonly used
> mechanism.  Note that an SSPI client can authenticate to a server which
> is using either SSPI or GSSAPI, and a GSSAPI client can authenticate to
> a server which is using either SSPI or GSSAPI.  Generally speaking,
> clients and servers on Windows are recommended to use SSPI while clients
> and servers on Unix (non-Windows) platforms use GSSAPI.

I developed the attached patch.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Only you can decide what is important to you.

--Y5H3x42QKFE4NrpI
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename="sspi.diff"

diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml
new file mode 100644
index a72f80f..fa53a0f
*** a/doc/src/sgml/client-auth.sgml
--- b/doc/src/sgml/client-auth.sgml
*************** omicron         bryanh
*** 1505,1514 ****
      <literal>negotiate</literal> mode, which will use
      <productname>Kerberos</productname> when possible and automatically
      fall back to <productname>NTLM</productname> in other cases.
!     <productname>SSPI</productname> authentication only works when both
!     server and client are running <productname>Windows</productname>,
!     or, on non-Windows platforms, when <productname>GSSAPI</productname>
!     is available.
     </para>
  
     <para>
--- 1505,1514 ----
      <literal>negotiate</literal> mode, which will use
      <productname>Kerberos</productname> when possible and automatically
      fall back to <productname>NTLM</productname> in other cases.
!     <productname>SSPI</productname> and <productname>GSSAPI</productname>
!     interoperate as clients and servers.  It is recommended to use
!     <productname>SSPI</productname> on Windows clients and servers and
!     <productname>GSSAPI</productname> on non-Windows platforms.
     </para>
  
     <para>

--Y5H3x42QKFE4NrpI--