Re: Patch to add Heimdal kerberos support - Mailing list pgsql-patches

From Tom Lane
Subject Re: Patch to add Heimdal kerberos support
Date
Msg-id 29385.1005610445@sss.pgh.pa.us
Whole thread Raw
In response to Re: Patch to add Heimdal kerberos support  (Bill Studenmund <wrstuden@netbsd.org>)
Responses Re: Patch to add Heimdal kerberos support  (Tom Lane <tgl@sss.pgh.pa.us>)
List pgsql-patches
Bill Studenmund <wrstuden@netbsd.org> writes:
> I think the point is this test and the code after it makes sure that your
> kerberos and your postgres usernames match. I think that's VERY important.
> Otherwise I could log into kerberos as wrstuden and access postgres as
> user tgl. That seems BAD to me. :-)

Well, it's not clear to me.  Where did the ticket come from?  Perhaps
we've already determined that you are who you say you are just by being
able to acquire the ticket.  Even more to the point are the comments in
front of the pg_an_to_ln subroutine: sure, we may be comparing against
*something* extracted from the ticket, but it's not at all clear that
it's a username.  Seems like there's lots of potential for BADness in
that.

            regards, tom lane

pgsql-patches by date:

Previous
From: Bill Studenmund
Date:
Subject: Re: Patch to add Heimdal kerberos support
Next
From: Bruce Momjian
Date:
Subject: Re: [ODBC] MD5 support for ODBC