Re: User Authentication: LDAP and "local" accounts concurrently ?

Поиск
Список
Период
Сортировка
От Stephen Frost
Тема Re: User Authentication: LDAP and "local" accounts concurrently ?
Дата
Msg-id 20181124200801.GM3415@tamriel.snowman.net
обсуждение исходный текст
Ответ на Re: User Authentication: LDAP and "local" accounts concurrently ?  ("Lentes, Bernd" <bernd.lentes@helmholtz-muenchen.de>)
Ответы Re: User Authentication: LDAP and "local" accounts concurrently ?  ("Lentes, Bernd" <bernd.lentes@helmholtz-muenchen.de>)
Список pgsql-admin
Greetings,

* Lentes, Bernd (bernd.lentes@helmholtz-muenchen.de) wrote:
> ----- Am 23. Nov 2018 um 22:44 schrieb Stephen Frost sfrost@snowman.net:
> > No, Kerberos/GSSAPI *never* transmits the user's password to the server.
> > The user's password is actually used as an encryption key and is known
> > only to the KDC (your domain controllers) and the user.  The KDC and the
> > PG server then share a different encryption key (the service principal).
> > When the user wants to connect to PG they ask the KDC for a ticket which
> > the KDC returns to the user as a blob which contains some information
> > for the PG server encrypted with the PG server's key and then encrypts
> > that and sends it to the user, who then decrypts it and uses it to
> > connect to the PG server.
> >
> > How all of that works is a bit complicated but thankfully you don't
> > really need to worry about that- Windows and Active Directory handle
> > almost all of it.  All you need to do is create a service principal in
> > active directory for the PG server and then export it and copy it over
> > to the PG server and then enable gssapi in PG.
>
> thanks again for your answer. Does my client application (geneious, a bioinfromatic tool)
> have to support Kerberos in any way ?

Yes, but it might already have it, depending on what library is being
used to talk to PostgreSQL.  The C library interface for PG, libpq, for
example, supports Kerberos and just has to be built with it (which most
versions you'll find have been).  If the application is JDBC and uses
the PostgreSQL JDBC driver, that also supports Kerberos.  If the
application is written in another language like Perl or Python and is
using the common libraries for those (DBD::Pg, psycopg2), which use
libpq underneath, then it depends on the way that version of libpq was
built, but, again, most of the libpq builds out there support Kerberos.

I don't know anything about geneious, but hopefully it's using libpq or
JDBC in some fashion and already has Kerberos support thanks to those
libraries having it.

Thanks!

Stephen

Вложения

В списке pgsql-admin по дате отправления:

Предыдущее
От: "Lentes, Bernd"
Дата:
Сообщение: Re: User Authentication: LDAP and "local" accounts concurrently ?
Следующее
От: "Lentes, Bernd"
Дата:
Сообщение: Re: User Authentication: LDAP and "local" accounts concurrently ?