From: Robbie Harwood <rharwood@redhat.com>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v2] GSSAPI encryption support
In-Reply-To: 
 <CAB7nPqTgr+aOZFmbORwxX9sZ7f3re4FuQFZyqdHP8AnOZPqrgw@mail.gmail.com>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
 <CAB7nPqRGQ60PWLb-CLLrvMoQwPAbnu-961W+xGPvG62RMSkcZQ@mail.gmail.com>
 <jlg37yo7mj2.fsf@thriss.redhat.com>
 <CAB7nPqTQM5dfhMh6yskkt=w1032iJ8ggnJu9y+tZBmwwhzEZKw@mail.gmail.com>
 <jlgsi6n8rum.fsf@thriss.redhat.com>
 <CAB7nPqQ7daftDPRTxvyPBFLmZnX-0vTku+H1ft7tqNmSxca3BA@mail.gmail.com>
 <CAB7nPqTgr+aOZFmbORwxX9sZ7f3re4FuQFZyqdHP8AnOZPqrgw@mail.gmail.com>
User-Agent: Notmuch/0.18.2 (http://notmuchmail.org) Emacs/24.4.1
 (x86_64-pc-linux-gnu)
Date: Wed, 16 Sep 2015 15:22:59 -0400
Message-ID: <jlgvbba5fu4.fsf@thriss.redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha1; protocol="application/pgp-signature"
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

--=-=-=
Content-Type: text/plain

Michael Paquier <michael.paquier@gmail.com> writes:

> On Thu, Sep 10, 2015 at 4:27 PM, Michael Paquier <michael.paquier@gmail.com> wrote:
>> On Thu, Sep 10, 2015 at 1:44 AM, Robbie Harwood <rharwood@redhat.com> wrote:
>>> Michael Paquier <michael.paquier@gmail.com> writes:
>>>> On Wed, Sep 9, 2015 at 4:12 AM, Robbie Harwood wrote:
>>>>> Michael Paquier writes:
>>>>> As promised, here's a V2 to address your issues with comments.  I
>>>>> haven't heard back on the issues you found in testing, so no other
>>>>> changes are present.
>>>>
>>>> Well, the issue is still here: login through gssapi fails with your
>>>> patch, not with HEAD. This patch is next on my review list by the
>>>> way so I'll see what I can do about it soon even if I am in the US
>>>> for Postgres Open next week. Still, how did you test it? I am just
>>>> creating by myself a KDC, setting up a valid credential with kinit,
>>>> and after setting up Postgres for this purpose the protocol
>>>> communication just fails.
>>>
>>> My KDC is setup through freeIPA; I create a service for postgres,
>>> acquire a keytab, set it in the config file, and fire up the server.
>>> It should go without saying that this is working for me, which is
>>> why I asked you for more information so I could try to debug.  I
>>> wrote a post on this back in June when this was still in
>>> development:
>>> http://mivehind.net/page/view-page-slug/16/postgres-kerberos
>>
>> Hm. OK. I'll give it a try with freeipa and your patch with Fedora
>> for example. Could you as well try the configuration I have used? In
>> any case, it seems to me that we have a real problem with your patch:
>> the gss authentication protocol is broken with your patch and *not*
>> HEAD when using a custom kdc like the one I have set up manually on
>> one of my VMs.
>
> Looking more at this stuff. Your post assumes that you have an IPA
> server available (I am not really familiar with this software stack)
> already configured at hand so as you do not need to worry about any
> low-level configuration and a KDC is provided as well, among other
> things like ntpd or an apache instance. Well, the thing is that we
> just need is a KDC for this patch to have an environment suitable for
> testing, and some magic commands with kadmin.local, kinit, etc, and
> not the whole set of features that an IPA server provides (when
> kicking ipa-server-install one needs to provide a realm name, a KDC
> admin password, so that's basically just a wrapper setting up
> krb5.conf, which is handy when you want to have the full set in your
> hands actually, though just to test this patch it does not seem worth
> it). And I imagine that you do have an IPA server already set
> facilitating your work.
>
> Still, I gave it a try on a Fedora host, giving up after facing
> several failures when trying to install the server. because of several
> features.

I'm sorry to hear that FreeIPA didn't work for you.  I'd be remiss if I
didn't suggest you file bugs against the project for things that are
broken, though that's somewhat orthogonal to the patchset at hand.

I gave your setup a try; I spun up a fc22 machine (krb5v1.13.2), and
installed the KDC as per your instructions.  I only did two things
differently: I'm using the default unit file for krb5kdc, and I'm using
the postgres base dir /var/lib/pgsql/data (this is a Fedora default and
I'm sure it doesn't matter for purposes of this).

I have no issues, no sync loss; nothing is amiss as far as I can see.
If there is actually a problem here, I need more information from you.
At the very least, as previously mentioned, I need to know what messages
went over the wire to/from the server before it occurred, and what
command (if it it made it to command processing) it was in the midst of
sending.

Thanks,
--Robbie

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJV+cGUAAoJECUy+RdqlaRCWsQQAI6PKwTlN/6fhGxtfdtpEatw
9r9azDI7OvvPrp8Z72M7exZm5RJ5QXVuNvBE7cHBE/6weK3O9zmvcQJuVIcsD+C/
6MBYpSDMrBOE68lubwjuk8dzUTX6NTlgUadC+6R/0QFwp8EMzsGvXzjm3CtIzIPG
9rVHWL0+egkbhA5UyFIlmeAyNd/+yEcvkNScQCH1rE5fVEVZqxb4MfwiK/TDJSh0
4UpPSoANQNSPKcLRtvX8Kn6r1vMF02fB7Vb7kE6TuZDjAjO1UHaaYY7esGvi2Uf+
YAwWkDYnSdtUkM6kjgpY0AsEHLnebOjLwAtih1ZGWK4Dm7lNOk+OwcQFxK35JDXn
q7nh+eyxIDEPjOyadl/b9HrTp9FMQZ7blSulGjyFjQncNrOvS8PptxzfaxJfBhKt
CF5HavyyM20qj6POMpBIuHbKp8xQPlqaxcbSlqNxvnUQmO5/NFuRZaLSAVhKk0Wq
0flaSAVIlp4mUbUXihv9+h+aTNqAilKW200b4hAZVSwesHLsWrcFCPcordPUg57e
Saep3vbqaAG4O47MPsN3pRC+iv9mpDA80Cx0wzaga14ZtRargKGfRxCAcLgnYN0m
WA0tkcL5aLTOEDx2Fd+SK2RlN1gQUpd6LnJwEtjoNM5zQkdEuwKs5Xhvg6rkRHf1
R1oATXMqzMGIXFUUSzFP
=RfGt
-----END PGP SIGNATURE-----
--=-=-=--