Re: User Authentication: LDAP and "local" accounts concurrently ?

Поиск
Список
Период
Сортировка
От Lentes, Bernd
Тема Re: User Authentication: LDAP and "local" accounts concurrently ?
Дата
Msg-id 33999F41-3B4A-46D3-BB18-531CF8662C0E@helmholtz-muenchen.de
обсуждение исходный текст
Ответ на Re: User Authentication: LDAP and "local" accounts concurrently ?  (Stephen Frost <sfrost@snowman.net>)
Ответы Re: User Authentication: LDAP and "local" accounts concurrently ?  (Stephen Frost <sfrost@snowman.net>)
Re: User Authentication: LDAP and "local" accounts concurrently ?  (Scott Ribe <scott_ribe@elevated-dev.com>)
Список pgsql-admin

Bernd Lentes

> Am 23.11.2018 um 20:14 schrieb Stephen Frost <sfrost@snowman.net>:
> 
> 
> With LDAP, the user's password will be seen by the PostgreSQL server,
> and sent over the wire in cleartext unless you're making sure to use TLS
> on the connection to PG (and if you're doing that you really want to
> make sure you have verify-full enabled on your clients....).
> 
> With Kerberos/GSSAPI, the authentication tokens are encrypted by the KDC
> (in your case, the AD domain controllers) and the user's password is
> never exposed.
> 
> Thanks!
> 
> Stephen

I‘m Not sure wether my Clients speak TLS. I‘m afraid they don‘t. 
But isn‘t then also the password transmitted in cleartext ? It must be transmitted from the client to the Pg Server,
independentof using LDAP or Kerberos/GSSAPU.
 

Bernd

Helmholtz Zentrum Muenchen
Deutsches Forschungszentrum fuer Gesundheit und Umwelt (GmbH)
Ingolstaedter Landstr. 1
85764 Neuherberg
www.helmholtz-muenchen.de
Aufsichtsratsvorsitzende: MinDirig.in Petra Steiner-Hoffmann
Stellv.Aufsichtsratsvorsitzender: MinDirig. Dr. Manfred Wolter
Geschaeftsfuehrer: Prof. Dr. med. Dr. h.c. Matthias Tschoep, Heinrich Bassler, Dr. rer. nat. Alfons Enhsen
Registergericht: Amtsgericht Muenchen HRB 6466
USt-IdNr: DE 12952167

В списке pgsql-admin по дате отправления:

Предыдущее
От: Stephen Frost
Дата:
Сообщение: Re: User Authentication: LDAP and "local" accounts concurrently ?
Следующее
От: Stephen Frost
Дата:
Сообщение: Re: User Authentication: LDAP and "local" accounts concurrently ?