pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feedRe: couple socket-connection questions
7+ messages / 4 participants
[nested] [flat]
* Re: couple socket-connection questions
@ 2003-05-30 18:42 Henry B. Hotz <hotz@jpl.nasa.gov>
0 siblings, 1 reply; 7+ messages in thread
From: Henry B. Hotz @ 2003-05-30 18:42 UTC (permalink / raw)
To: Daniel Kouril <kouril@ics.muni.cz>; +Cc: lukeh@PADL.COM; buckh@pobox.com; heimdal-discuss@sics.se; Dj.Byrne@jpl.nasa.gov; pgsql-docs
At 9:23 AM +0200 5/30/03, Daniel Kouril wrote:
>On Thu, May 29, 2003 at 05:48:44PM -0700, Henry B. Hotz wrote:
>> Actually that's mod_auth_krb, not kerb. They are different apache
>> modules and the one without the 'e' is newer. I found out about it
>> from the PostgreSQL manual. It claims to implement some Microsoft
>> IETF-draft which is also supported by Mozilla for getting Kerberos
>> credentials forwarded. If the connection doesn't support the
>> IETF-draft then it falls back to getting a name/password via basic
>> auth. With the right options apache will retain the (forwarded or
>> created) tgt which can be used by mod_perl (or presumably PHP) to
>> authenticate a connection with PostgreSQL.
>
>I don't know which module is meant by the PostgreSQL docs, but you can have
>a look at http://meta.cesnet.cz/software/heimdal/negotiate.en.html
>The page contains implementations of exact the functionality refered above.
Interesting.
I just repeated my Google search for mod-without-e and almost the
only hits are the PostgreSQL admin manual. I did find a
cross-reference to a sourceforge page
<http://modauthkerb.sourceforge.net/; which looks an awful lot like
the page I remember for the no-e module --- but it has an e.
My guess is that the module web page had a spelling error once which
was picked up by the PostgreSQL admin manual. The spelling error has
been fixed everywhere now, except at PostgreSQL.
I'm cc'ing the PG doc's list on this reply. Hopefully someone there
can tell us what the real situation is.
--
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: couple socket-connection questions
@ 2003-06-01 21:50 Peter Eisentraut <peter_e@gmx.net>
parent: Henry B. Hotz <hotz@jpl.nasa.gov>
0 siblings, 1 reply; 7+ messages in thread
From: Peter Eisentraut @ 2003-06-01 21:50 UTC (permalink / raw)
To: Henry B. Hotz <hotz@jpl.nasa.gov>; +Cc: Daniel Kouril <kouril@ics.muni.cz>; lukeh@PADL.COM; buckh@pobox.com; heimdal-discuss@sics.se; Dj.Byrne@jpl.nasa.gov; pgsql-docs
Henry B. Hotz writes:
> My guess is that the module web page had a spelling error once which
> was picked up by the PostgreSQL admin manual. The spelling error has
> been fixed everywhere now, except at PostgreSQL.
The mention in the PostgreSQL documentation was once submitted by an
external contributor and might have contained a typo. Would you like to
submit a correction, or should it be removed altogether? I got a little
bit lost about what is correct.
--
Peter Eisentraut peter_e@gmx.net
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: couple socket-connection questions
@ 2003-06-01 22:22 Henry B. Hotz <hotz@jpl.nasa.gov>
parent: Peter Eisentraut <peter_e@gmx.net>
0 siblings, 1 reply; 7+ messages in thread
From: Henry B. Hotz @ 2003-06-01 22:22 UTC (permalink / raw)
To: Peter Eisentraut <peter_e@gmx.net>; +Cc: Daniel Kouril <kouril@ics.muni.cz>; lukeh@PADL.COM; buckh@pobox.com; heimdal-discuss@sics.se; Dj.Byrne@jpl.nasa.gov; pgsql-docs
At 11:50 PM +0200 6/1/03, Peter Eisentraut wrote:
>Henry B. Hotz writes:
>
>> My guess is that the module web page had a spelling error once which
>> was picked up by the PostgreSQL admin manual. The spelling error has
>> been fixed everywhere now, except at PostgreSQL.
>
>The mention in the PostgreSQL documentation was once submitted by an
>external contributor and might have contained a typo. Would you like to
>submit a correction, or should it be removed altogether? I got a little
>bit lost about what is correct.
Gee, I was hoping you could tell me what was correct.
I'm guessing the correction should be: change mod_auth_krb to mod_auth_kerb.
I'll post more info in a month or two when I have more info (like
when I've tried it out).
--
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: couple socket-connection questions
@ 2003-06-02 11:51 Daniel Kouril <kouril@ics.muni.cz>
parent: Henry B. Hotz <hotz@jpl.nasa.gov>
0 siblings, 1 reply; 7+ messages in thread
From: Daniel Kouril @ 2003-06-02 11:51 UTC (permalink / raw)
To: Henry B. Hotz <hotz@jpl.nasa.gov>; +Cc: Peter Eisentraut <peter_e@gmx.net>; Daniel Kouril <kouril@ics.muni.cz>; lukeh@PADL.COM; buckh@pobox.com; heimdal-discuss@sics.se; Dj.Byrne@jpl.nasa.gov; pgsql-docs
On Sun, Jun 01, 2003 at 03:22:04PM -0700, Henry B. Hotz wrote:
> At 11:50 PM +0200 6/1/03, Peter Eisentraut wrote:
> >Henry B. Hotz writes:
> >
> >> My guess is that the module web page had a spelling error once which
> >> was picked up by the PostgreSQL admin manual. The spelling error has
> >> been fixed everywhere now, except at PostgreSQL.
> >
> >The mention in the PostgreSQL documentation was once submitted by an
> >external contributor and might have contained a typo. Would you like to
> >submit a correction, or should it be removed altogether? I got a little
> >bit lost about what is correct.
>
> Gee, I was hoping you could tell me what was correct.
>
> I'm guessing the correction should be: change mod_auth_krb to
> mod_auth_kerb.
The mod_auth_kerb module available from modauthkerb.sf.net doesn't provide
the full kerberos authentication (it only supports password verification
against KDC). Recently I've joined the modauthkerb.sf.net project trying to
incorporate the changes needed to implement full kerberos support, but I'm
not sure when it's ready.
So, as for the PostgreSQL docs, if you don't have any other modules in your
mind, I'd suggest to include references to both these module:
- mod_auth_kerb hosted by Sourceforge at modauthkerb.sf.net
- mod_auth_gss_krb5 available from
http://meta.cesnet.cz/software/negotiate.en.html
You can also state these two modules are being integrated.
Cheers,
--
Dan
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: couple socket-connection questions
@ 2003-06-06 18:08 Bruce Momjian <pgman@candle.pha.pa.us>
parent: Daniel Kouril <kouril@ics.muni.cz>
0 siblings, 1 reply; 7+ messages in thread
From: Bruce Momjian @ 2003-06-06 18:08 UTC (permalink / raw)
To: Daniel Kouril <kouril@ics.muni.cz>; +Cc: Henry B. Hotz <hotz@jpl.nasa.gov>; Peter Eisentraut <peter_e@gmx.net>; lukeh@PADL.COM; buckh@pobox.com; heimdal-discuss@sics.se; Dj.Byrne@jpl.nasa.gov; pgsql-docs
Patch applied to documentation to list two mod_auth kerberos projects.
Thanks.
---------------------------------------------------------------------------
Daniel Kouril wrote:
> On Sun, Jun 01, 2003 at 03:22:04PM -0700, Henry B. Hotz wrote:
> > At 11:50 PM +0200 6/1/03, Peter Eisentraut wrote:
> > >Henry B. Hotz writes:
> > >
> > >> My guess is that the module web page had a spelling error once which
> > >> was picked up by the PostgreSQL admin manual. The spelling error has
> > >> been fixed everywhere now, except at PostgreSQL.
> > >
> > >The mention in the PostgreSQL documentation was once submitted by an
> > >external contributor and might have contained a typo. Would you like to
> > >submit a correction, or should it be removed altogether? I got a little
> > >bit lost about what is correct.
> >
> > Gee, I was hoping you could tell me what was correct.
> >
> > I'm guessing the correction should be: change mod_auth_krb to
> > mod_auth_kerb.
>
> The mod_auth_kerb module available from modauthkerb.sf.net doesn't provide
> the full kerberos authentication (it only supports password verification
> against KDC). Recently I've joined the modauthkerb.sf.net project trying to
> incorporate the changes needed to implement full kerberos support, but I'm
> not sure when it's ready.
>
> So, as for the PostgreSQL docs, if you don't have any other modules in your
> mind, I'd suggest to include references to both these module:
> - mod_auth_kerb hosted by Sourceforge at modauthkerb.sf.net
> - mod_auth_gss_krb5 available from
> http://meta.cesnet.cz/software/negotiate.en.html
> You can also state these two modules are being integrated.
>
> Cheers,
>
> --
> Dan
>
> ---------------------------(end of broadcast)---------------------------
> TIP 1: subscribe and unsubscribe commands go to majordomo@postgresql.org
>
--
Bruce Momjian | http://candle.pha.pa.us
pgman@candle.pha.pa.us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073
Attachments:
/bjm/diff (text/plain, 1.4K) download
Index: doc/src/sgml/client-auth.sgml
===================================================================
RCS file: /cvsroot/pgsql-server/doc/src/sgml/client-auth.sgml,v
retrieving revision 1.46
diff -c -c -r1.46 client-auth.sgml
*** doc/src/sgml/client-auth.sgml 13 Mar 2003 01:30:26 -0000 1.46
--- doc/src/sgml/client-auth.sgml 6 Jun 2003 18:08:03 -0000
***************
*** 639,646 ****
</para>
<para>
! If you use <application>mod_auth_krb</application> and
! <application>mod_perl</application> on your
<productname>Apache</productname> web server, you can use
<literal>AuthType KerberosV5SaveCredentials</literal> with a
<application>mod_perl</application> script. This gives secure
--- 639,653 ----
</para>
<para>
! <ulink url="http://www.kernel.org/pub/linux/libs/pam/"><productname>Linux-PAM</>
! Page
!
! If you use <application>mod_auth_kerb</application> from
! <ulink url="http://modauthkerb.sf.net">http://modauthkerb.sf.net</ulink>
! or <application>mod_auth_gss_krb5</application> from
! <ulink url="http://meta.cesnet.cz/software/negotiate.en.html">
! http://meta.cesnet.cz/software/negotiate.en.html</ulink>,
! and <application>mod_perl</application> on your
<productname>Apache</productname> web server, you can use
<literal>AuthType KerberosV5SaveCredentials</literal> with a
<application>mod_perl</application> script. This gives secure
* Re: couple socket-connection questions
@ 2003-06-07 15:56 Peter Eisentraut <peter_e@gmx.net>
parent: Bruce Momjian <pgman@candle.pha.pa.us>
0 siblings, 1 reply; 7+ messages in thread
From: Peter Eisentraut @ 2003-06-07 15:56 UTC (permalink / raw)
To: Bruce Momjian <pgman@candle.pha.pa.us>; +Cc: Daniel Kouril <kouril@ics.muni.cz>; Henry B. Hotz <hotz@jpl.nasa.gov>; lukeh@PADL.COM; buckh@pobox.com; Dj.Byrne@jpl.nasa.gov; pgsql-docs
Bruce Momjian writes:
> Patch applied to documentation to list two mod_auth kerberos projects.
> Thanks.
Do both of these support AuthType KerberosV5SaveCredentials? I guess not,
from this:
> > > I'm guessing the correction should be: change mod_auth_krb to
> > > mod_auth_kerb.
> >
> > The mod_auth_kerb module available from modauthkerb.sf.net doesn't provide
> > the full kerberos authentication (it only supports password verification
> > against KDC). Recently I've joined the modauthkerb.sf.net project trying to
> > incorporate the changes needed to implement full kerberos support, but I'm
> > not sure when it's ready.
--
Peter Eisentraut peter_e@gmx.net
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: couple socket-connection questions
@ 2003-06-07 16:25 Bruce Momjian <pgman@candle.pha.pa.us>
parent: Peter Eisentraut <peter_e@gmx.net>
0 siblings, 0 replies; 7+ messages in thread
From: Bruce Momjian @ 2003-06-07 16:25 UTC (permalink / raw)
To: Peter Eisentraut <peter_e@gmx.net>; +Cc: Daniel Kouril <kouril@ics.muni.cz>; Henry B. Hotz <hotz@jpl.nasa.gov>; lukeh@PADL.COM; buckh@pobox.com; Dj.Byrne@jpl.nasa.gov; pgsql-docs
OK, I didn't understand what supporting only password verification meant
in terms of our software. I will remove the second one.
---------------------------------------------------------------------------
Peter Eisentraut wrote:
> Bruce Momjian writes:
>
> > Patch applied to documentation to list two mod_auth kerberos projects.
> > Thanks.
>
> Do both of these support AuthType KerberosV5SaveCredentials? I guess not,
> from this:
>
> > > > I'm guessing the correction should be: change mod_auth_krb to
> > > > mod_auth_kerb.
> > >
> > > The mod_auth_kerb module available from modauthkerb.sf.net doesn't provide
> > > the full kerberos authentication (it only supports password verification
> > > against KDC). Recently I've joined the modauthkerb.sf.net project trying to
> > > incorporate the changes needed to implement full kerberos support, but I'm
> > > not sure when it's ready.
>
> --
> Peter Eisentraut peter_e@gmx.net
>
>
--
Bruce Momjian | http://candle.pha.pa.us
pgman@candle.pha.pa.us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073
^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2003-06-07 16:25 UTC | newest]
Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2003-05-30 18:42 Re: couple socket-connection questions Henry B. Hotz <hotz@jpl.nasa.gov>
2003-06-01 21:50 ` Peter Eisentraut <peter_e@gmx.net>
2003-06-01 22:22 ` Henry B. Hotz <hotz@jpl.nasa.gov>
2003-06-02 11:51 ` Daniel Kouril <kouril@ics.muni.cz>
2003-06-06 18:08 ` Bruce Momjian <pgman@candle.pha.pa.us>
2003-06-07 15:56 ` Peter Eisentraut <peter_e@gmx.net>
2003-06-07 16:25 ` Bruce Momjian <pgman@candle.pha.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox