Date: Sun, 13 Mar 2005 15:07:51 +0100
From: Peter Much <pmc@citylink.dinoex.sub.org>
To: pgsql-interfaces@postgresql.org
Subject: [Tcl] did pgaccess ever work with kerberos?
Message-ID: <20050313140751.GA46146@gate.oper.dinoex.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.4.2.1i

Hi all,

I am trying to get postgresql 7.4.5 running, and am stuck in problems
with pgaccess.

That is, pgaccess does not want to connect with kerbneros
authentication, and I have analyzed this so far that it seems to me
this is a fundamental question about doing a connect with kerberos
from a plain tcl script.

Pgaccess tries to load the libpgtcl. It does so first by trying
	package require Pgtcl
and this fails for reasons yet unknown to me. Then it does by
	load /usr/local/lib/libpqtcl.so
and this fails because it does not find symbols which are in the
kerberos libraries:

	ERROR MESSAGE: couldn't load file "/usr/local/lib/libpgtcl.so": 
	/usr/local/lib/libpq.so.3: Undefined symbol "krb5_cc_get_principal"

If I list all the kerberos libraries in the pgaccess script, so that
they are also loaded, then it complains about the initialisation
procedures in these libraries. This seems not the way to go.

If I try to connect from pgtclsh, that works just fine. But pgtclsh
is not a plain Tcl script. It is a binary, and so it does not have
to load sharedlibs explicitely, but gets them on-demand from the
system loader.

The fun is, I have postgresql 7.1.3 running, and that old pgaccess
that did come with 7.1.3, and that does work with kerberos.
So I checked how this happens. That pgaccess does also 
	load /usr/local/lib/libpgtcl.so
and there it works. But the point is, I am running heimdal kerberos,
and postgresql 7.1.3 did not support heimdal kerberos. Therefore
I linked that postgres against MIT kerberos, and I linked it
statically (I removed all the *.so libraries at linktime, so that
the linker would only see the *.a libraries). Therefore, my libpq.so
got rather large and does CONTAIN all needed kerberos functions.

Is this the only trick to get it running? Or is there a more clean way?

Fundamentally, my question is, if I do not use pgtclsh, but plain
tclsh (or wish), and want to use libpgtcl and access the database
from there, how do I do this (and get the kerberos support)?

PMc