Обсуждение: BUG #16066: Ldap Authentication failure on PostgreSQL 10.10

The following bug has been logged on the website:

Bug reference:      16066
Logged by:          Yudhveer Kandukuri
Email address:      k.yudhveer@gmail.com
PostgreSQL version: 10.10
Operating system:   Ubuntu 18.04
Description:

Here are the pg_hba.conf entry for ldap.....

host      Tom           Tom           10.10.117.43/32         ldap
ldapserver=10.10.117.43 ldapbasedn="ou=People,dc=internal,dc=g2llc"
ldapbinddn="cn=svc_ldap,ou=People,dc=internal,dc=g2llc"
ldapbindpasswd="Test123#" ldapport=389 ldapsearchattribute="uid"

When I am trying to connect to postgresql on remote server, I am getting the
message as no entry for "Tom" in pg_hba.conf file where the postgresql is
running on the remote server.

Already created the user "Tom" in postgresql and also created the user "Tom"
in ldap and also created one more ldap user account "i.e., svc_ldap" in
ldap.

Not Sure..what else I need to configure to make the Postgresql user to
authenticate with ldap

Thanks and regards
Yudhveer Kandukuri

Greetings,

* PG Bug reporting form (noreply@postgresql.org) wrote:
> host      Tom           Tom           10.10.117.43/32         ldap
> ldapserver=10.10.117.43 ldapbasedn="ou=People,dc=internal,dc=g2llc"
> ldapbinddn="cn=svc_ldap,ou=People,dc=internal,dc=g2llc"
> ldapbindpasswd="Test123#" ldapport=389 ldapsearchattribute="uid"
>
> When I am trying to connect to postgresql on remote server, I am getting the
> message as no entry for "Tom" in pg_hba.conf file where the postgresql is
> running on the remote server.
>
> Already created the user "Tom" in postgresql and also created the user "Tom"
> in ldap and also created one more ldap user account "i.e., svc_ldap" in
> ldap.
>
> Not Sure..what else I need to configure to make the Postgresql user to
> authenticate with ldap

This isn't a bug, and we've already pointed out that you need to make
sure that the IP in the pg_hba.conf is the one the client is connecting
from.  It's not the LDAP server.  Also, as mentioned, you'd really be
better off using GSSAPI authentication with Active Directory, using LDAP
isn't nearly as secure, nor is it a good practice.

Thanks,

Stephen