Re: pg_service and ldap - Mailing list pgsql-admin

From Häfliger Guido
Subject Re: pg_service and ldap
Date
Msg-id D2417C80A342B246BEAF2C90A301E0AF18368865@MailNT.vogelwarte.ch
Whole thread Raw
In response to Re: pg_service and ldap  (Albe Laurenz <laurenz.albe@wien.gv.at>)
Responses Re: pg_service and ldap
List pgsql-admin
Thanks for the infos. Concerning authentification, one thing is not clear for me. In the docs it is written that GSSAPI
onlinux must be enabled on building postgres, so I have reallly to compile postgres for enabling SSO with windows
clientsto linux database server? I'm working with pg version 9.4 on ubuntu 14.04. 

Guido

________________________________________
Von: Albe Laurenz [laurenz.albe@wien.gv.at]
Gesendet: Donnerstag, 26. November 2015 21:07
An: Häfliger Guido; pgsql-admin@postgresql.org
Betreff: RE: pg_service and ldap

Häfliger Guido wrote:
> I would like to configure pg_service.conf with an ldap-url so that pg_service takes the login
> informations from a Windows Domain Server (windows-client is connected to the domain).
> The database is running on a linux server where pam-authentification is configured.
> I want omit that the user have to login another time when he connect to the database.
> Is this possible? If yes, can somebody give me a hint how to set the ldap-url?

pg_service.conf cannot help you with authentication, it helps you to map a
symbolic database name to the actual connection parameters.
The only difference when you use an LDAP URL is that the connection data are
not stored locally on the client, but on an LDAP server.

You could theoretically store the clear text password on the LDAP server and
use it for authentiction, but that would be a very bad idea since the LDAP server
must be configured for anonymous bind.
Think of it as a kind of public phone book.

If you want single sign-on on Windows, you should look into SSPI authentication:
http://www.postgresql.org/docs/9.4/static/auth-methods.html#SSPI-AUTH

Yours,
Laurenz Albe


pgsql-admin by date:

Previous
From: Kouber Saparev
Date:
Subject: Re: VACUUM unable to accomplish because of a non-existent MultiXactId
Next
From: Alvaro Herrera
Date:
Subject: Re: VACUUM unable to accomplish because of a non-existent MultiXactId