John DeSoi <john@desoi.dev> writes:
> On Nov 30, 2023, at 2:07 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> What troubles me about that stack trace is the references to Heimdal.
>> We gave up supporting Heimdal (and v16 explicitly rejects building
>> with it) because its support for Kerberos credentials was too
>> incomplete and flaky. So I'm inclined to guess that you are running
>> into some Heimdal bug. Try to rebuild libpq using MIT Kerberos
>> and see if things get better.
> Is there a way to simply disable GSSAPI authentication? I could not find it.
gssencmode=disable in your connection options; but that's a tad
inconvenient probably.
> The otool output below shows that Apple's Kerberos is being used and I assume by extension, their Heimdal library.
TheHeimdal project told me as much - Apple has a fork and would not pull from their project.
Ugh, not only Heimdal but a very obsolete version thereof? It borders
on negligence for the homebrew PG package to be building against that.
They should be pulling in homebrew's MIT Kerberos package and using
that, if they want to enable GSSAPI.
regards, tom lane
