Re: LDAP Configuration - Mailing list pgsql-admin

From Anjul Tyagi
Subject Re: LDAP Configuration
Date
Msg-id em0e2934f7-678a-4373-b924-6ebb41e70abe@iboss01108
Whole thread Raw
In response to Re: LDAP Configuration  (Laurenz Albe <laurenz.albe@cybertec.at>)
List pgsql-admin
Thanks Laurenz Albe!!!

I did the same and it worked for me... 

 
 
 

Regards,

Anjul TYAGI

 

ü Go Green


------ Original Message ------
From: "Laurenz Albe" <laurenz.albe@cybertec.at>
To: "Anjul Tyagi" <anjul@ibosstech-us.com>; "pgsql-admin" <pgsql-admin@postgresql.org>
Sent: 4/1/2020 5:03:04 PM
Subject: Re: LDAP Configuration

On Wed, 2020-04-01 at 10:29 +0000, Anjul Tyagi wrote:
we are implementing the LDAP authentication and we are able to connect with LDAP and able to
authenticate the user with that. However we have 2 type of users, one - corporate users and
available of Active Directory and second application user, which is used by different
application to connect with database.
 
Below entry i did in the pg_hba.conf file, if i create user in DB (similar exist on AD) it works.
However if i create one user with password, it calls the LDAP server for authentication
and fails as it does not exists in AD.
 
host all all 0.0.0.0/0 ldap ldapserver=<LDAL Server> ldapbasedn="OU=Corporate,DC=etch,dc=com" ldapbinddn="CN=AdSyncAcct,OU=Service Accounts,DC=etch,DC=com"
ldapbindpasswd="Password" ldapsearchattribute="sAMAccountName"
 
we are using the postgres 10.10 version.
 
can you please suggest the pg_hba.conf file entry, that will help us to authenticate the users
from LDAP and from postgres as well.
 
Create a NOLOGIN role "ldapusers" in PostgreSQL and assign the users to authenticate
with LDAP to that group.
 
Then use two lines in pg_hba.conf:
 
host all +ldapusers 0.0.0.0/0 ldap ...
host all all 0.0.0.0/0 scram-sha-256
 
All users in the "ldapusers" group will be authenticated with LDAP,
and the others will "fall through" to the password authentication.
 
Yours,
Laurenz Albe
--
 

pgsql-admin by date:

Previous
From: Laurenz Albe
Date:
Subject: Re: LDAP Configuration
Next
From: Stephen Frost
Date:
Subject: Re: LDAP Configuration