Re: How to ensure that SSPI support (Windows) enabled? - Mailing list pgsql-hackers

From Dimitry Markman
Subject Re: How to ensure that SSPI support (Windows) enabled?
Date
Msg-id MN2PR05MB63979A9296010E3DEF57D9F0C47C9@MN2PR05MB6397.namprd05.prod.outlook.com
Whole thread Raw
In response to Re: How to ensure that SSPI support (Windows) enabled?  (Stephen Frost <sfrost@snowman.net>)
List pgsql-hackers

Thanks Stephen, very useful information

dm

 

 

On 5/19/23, 12:02 PM, "Stephen Frost" <sfrost@snowman.net> wrote:

Greetings,

 

Please don't top-post.

 

* Dimitry Markman (dmarkman@mathworks.com) wrote:

> I was asking our 3p library people how to add windows support to gss and they said that on windows we should use SSPI

 

They're correct.

 

> I’m not really familiar with either gssapi or SSPI

 

Kerberos support is provided through SSPI on Windows.  On Linux and Unix

systems in general, it's provided through GSSAPI.  On the wire, the two

are (mostly) compatible.

 

> I see that macOS has builtin support for gssapi, so all I need is to use –with-gssapi

 

On most Unix-based systems (and certainly for MacOS), you should be

installing MIT Kerberos and using that for your GSSAPI library.  The

GSSAPI library included with MacOS has not been properly maintained by

Apple and is woefully out of date and using it will absolutely cause you

undue headaches.

 

> On linux I use MIT Kerberos that we build in our 3p environment (only linux)

 

Yes, MIT Kerberos on Linux makes sense.

 

> When I ask to build MIT Kerberos on windows that’s when I was advised simply to use SSPI

 

That's correct, you should be using SSPI on Windows is the vast majority

of cases.

 

Thanks,

 

Stephen

 

pgsql-hackers by date:

Previous
From: Tom Lane
Date:
Subject: Re: Assert failure of the cross-check for nullingrels
Next
From: Andres Freund
Date:
Subject: Re: Add operator for dividing interval by an interval