Subject: Community accounts

From: Peter Eisentraut <[email-masked]>
Date: Wed, 12 Mar 2008 20:10:51 +0100

Are the "community accounts" (used by the wiki, for example) available to 
authenticate against from remote services, for example via LDAP?  I might 
like to use them for the Git service, for example.

Also, is there a plan for keeping "community" accounts, PgFoundry accounts, 
and developer.postgresql.org shell accounts the same, lest we create a big 
mess?

---

From: "Dave Page" <[email-masked]>
Date: Wed, 12 Mar 2008 19:27:04 +0000

> like to use them for the Git service, for example.

Not yet - the Wiki is the fisrt truly external resource to be
integrated, and although we did consider LDAP and OpenID, in the end
we decided that a custom auth plugin for mediawiki using the backend
database API via SSL connection was the least painful option.

We could certainly look at LDAP/OpenID more closely though.

> and developer.postgresql.org shell accounts the same, lest we create a big

I'm certainly interested in doing so for pgFoundry if we can figure
out how given the interaction between the GForge and OS
authentication. I'm not so wild about the developer shell accounts as
we've actually only got a handful of those left anyway - and most are
for the sysadmin team who don't necessarily want centralised
authentication in case something goes horribly wrong leaving the
entire domain inaccessible.

-- 
Dave Page
EnterpriseDB UK Ltd: http://www.enterprisedb.com
PostgreSQL UK 2008 Conference: http://www.postgresql.org.uk

---

From: Magnus Hagander <[email-masked]>
Date: Wed, 12 Mar 2008 22:03:37 +0100

> We could certainly look at LDAP/OpenID more closely though.

Absolutely. The idea is to make it available to all services that could
use them. What options are available for GIT?

LDAP is probably the most complex of available protocols for something
as simple as authentication, but if that's all it can do, we could
certainly look at the possibility.

> entire domain inaccessible.

+1 on both those.

//Magnus

---

From: Peter Eisentraut <[email-masked]>
Date: Wed, 12 Mar 2008 22:39:12 +0100

Magnus Hagander wrote:
> The idea is to make it available to all services that could

It's all shell accounts.  So something like PAM or whatever FreeBSD does would 
do the job.

---

From: Magnus Hagander <[email-masked]>
Date: Wed, 12 Mar 2008 23:01:49 +0100

> It's all shell accounts.  So something like PAM or whatever FreeBSD does would 

Oh, yuck. You'd need some other level of authorization as well then,
because we certainly don't want to add all our community users as shell
users IMHO. In fact, I wouldn't add any users other than those that
absolutely need it...

//Magnus

---

From: "Joshua D. Drake" <[email-masked]>
Date: Wed, 12 Mar 2008 15:04:46 -0700

On Wed, 12 Mar 2008 23:01:49 +0100
Magnus Hagander <[email-masked]> wrote:

> > It's all shell accounts.  So something like PAM or whatever FreeBSD
> > does would do the job.
> 
> because we certainly don't want to add all our community users as
> shell users IMHO. In fact, I wouldn't add any users other than those
> that absolutely need it...

Pam can auth off PG.

Joshua D. Drake

- -- 
The PostgreSQL Company since 1997: http://www.commandprompt.com/ 
PostgreSQL Community Conference: http://www.postgresqlconference.org/
Donate to the PostgreSQL Project: http://www.postgresql.org/about/donate
      PostgreSQL political pundit | Mocker of Dolphins