Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1ZZiUS-0008Re-Ei for pgsql-hackers@arkaria.postgresql.org; Wed, 09 Sep 2015 16:44:56 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84) (envelope-from ) id 1ZZiUR-00032S-JI for pgsql-hackers@arkaria.postgresql.org; Wed, 09 Sep 2015 16:44:55 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84) (envelope-from ) id 1ZZiUQ-00031k-Bq for pgsql-hackers@postgresql.org; Wed, 09 Sep 2015 16:44:54 +0000 Received: from mx1.redhat.com ([209.132.183.28]) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84) (envelope-from ) id 1ZZiUM-0003H4-Dj for pgsql-hackers@postgresql.org; Wed, 09 Sep 2015 16:44:52 +0000 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by mx1.redhat.com (Postfix) with ESMTPS id EE3492EB675; Wed, 9 Sep 2015 16:44:48 +0000 (UTC) Received: from localhost (vpn-63-206.rdu2.redhat.com [10.10.63.206]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t89GimFe028861; Wed, 9 Sep 2015 12:44:48 -0400 From: Robbie Harwood To: Michael Paquier Cc: PostgreSQL mailing lists Subject: Re: [PATCH v2] GSSAPI encryption support In-Reply-To: References: User-Agent: Notmuch/0.18.2 (http://notmuchmail.org) Emacs/24.4.1 (x86_64-pc-linux-gnu) Date: Wed, 09 Sep 2015 12:44:49 -0400 Message-ID: MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha1; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26 X-Pg-Spam-Score: -6.9 (------) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org --=-=-= Content-Type: text/plain Michael Paquier writes: > On Wed, Sep 9, 2015 at 4:12 AM, Robbie Harwood wrote: >> Michael Paquier writes: >> As promised, here's a V2 to address your issues with comments. I >> haven't heard back on the issues you found in testing, so no other >> changes are present. > > Well, the issue is still here: login through gssapi fails with your > patch, not with HEAD. This patch is next on my review list by the way > so I'll see what I can do about it soon even if I am in the US for > Postgres Open next week. Still, how did you test it? I am just > creating by myself a KDC, setting up a valid credential with kinit, > and after setting up Postgres for this purpose the protocol > communication just fails. My KDC is setup through freeIPA; I create a service for postgres, acquire a keytab, set it in the config file, and fire up the server. It should go without saying that this is working for me, which is why I asked you for more information so I could try to debug. I wrote a post on this back in June when this was still in development: http://mivehind.net/page/view-page-slug/16/postgres-kerberos --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJV8GIBAAoJECUy+RdqlaRC34MP/iuhzS0BrP3P8UJn39Wg82n9 TXU6Kn4Ef0HmF7DL73/Xw57zcAdcZZV5KP/MEh1uA9YztyXa30lsENNXZcH1PhtO e3dRG3PBTYD46K+pFhJ8Tbb/CMcR8ACqGtEmvc6gbRW8y3zHupU6AFhMG1XMxhme p+NMg02QhRafs3Ny99d1tpe6CpeRVQAeBu+KOrm8qPDfnRXYkEqQ5flduo9BO7pJ 6XBYt9mUVpm5U+ykryTzzbNbNzB7DrhdjaoRj1AamG6o3yfKNk5dkvKcx6xl8Hmi mAlSdnqGiJiQAAOG8iK6YV0dXdfaLLX/+wWTDcTYwE86OYRaiyLlLC1h0bQmxulS dAF/ZOn/QrPNSayLWDC3v8S8sQ33aDBpQBYd9+YnfsJ/S8hqxw1y2voFGefhGuav AQ1sHfAOacIT0HRl2Um+5XZACoBSrmHMLNIYcXPCE0dkq3XWKyqRNr5kQilHTbPL KehSOOhiaokV/E7PcwJ6i0Kyr9OuOI13feKmh55eMk1N6pKrTF8afBnu5WfRBBDI WqVYLRCAqsTQxLz3B3vu95zU3H/dFQTsKlb7VPkybwpy52zDK7ulEqL8PxjAfYBv TlEwPNRclGwmAtVdFNmjzBQiRJ2hggKrPSNmEV8nmMZ9nku1oQhavLl54AYP/0FQ D0j97jVfYr6Nd+HMyhKa =lo8+ -----END PGP SIGNATURE----- --=-=-=--