Postgres Pro
Downloads
Home   >   mailing lists

Re: Ldap config for Active Directory - Mailing list pgsql-admin

From Stephen Frost
Subject Re: Ldap config for Active Directory
Date
Msg-id YyN6HuBhtzaObYLR@tamriel.snowman.net
Whole thread Raw
In response to Ldap config for Active Directory  (Sylvain Deveaux <Sylvain.Deveaux@niwa.co.nz>)
Responses Re: Ldap config for Active Directory  (Sylvain Deveaux <Sylvain.Deveaux@niwa.co.nz>)
List pgsql-admin
Tree view 
Greetings,

* Sylvain Deveaux (Sylvain.Deveaux@niwa.co.nz) wrote:
> We have to use LDAP in our AD environment, Users could use Kerberos but service accounts used by Apps can't.

Why do you say that you can't use kerberos w/ apps?

> host all +ldap_roles 192.168.0.0/16 ldap
ldapurl="ldap://ldap.service:636/ou=AdminOU,dc=domain,dc=org?sAMAccountName?sub"
ldapbinddn="cn=postgres_bind,ou=level1,ou=level2,dc=domain,dc=org"ldapbindpasswd="password"
 

Note that using ldap auth means sending the user's password to the PG
server in cleartext, which is extremely insecure and means that a
compromised PG server could be used to steal the credentials of any user
logging in using this method.

Thanks,

Stephen
Attachment

pgsql-admin by date:

Previous
From: Laurenz Albe
Date:
Subject: Re: Local parent table and Foreign table(s) as partition(s), is it possible?
Next
From: Sylvain Deveaux
Date:
Subject: Re: Ldap config for Active Directory