Thread: BUG #16320: GSSAPI Error

The following bug has been logged on the website:

Bug reference:      16320
Logged by:          Kinjal Brahmbhatt
Email address:      brahmbhattkinjal18@gmail.com
PostgreSQL version: 12.2
Operating system:   Mac
Description:

Hello, i tried to uninstall and reinstall the Postgresql multiple times, but
every time i go to enter my password, it gives me a GSSAPI error. 

Please advise. 

Thank you,
Kinjal Brahmbhatt

Greetings,

* PG Bug reporting form (noreply@postgresql.org) wrote:
> Hello, i tried to uninstall and reinstall the Postgresql multiple times, but
> every time i go to enter my password, it gives me a GSSAPI error.

You're probably getting bit by the broken GSSAPI library on OSX.  Try
installing a supported library (MIT Kerberos or Heimdal).

Thanks,

Stephen

Stephen Frost <sfrost@snowman.net> writes:
> * PG Bug reporting form (noreply@postgresql.org) wrote:
>> Hello, i tried to uninstall and reinstall the Postgresql multiple times, but
>> every time i go to enter my password, it gives me a GSSAPI error.

> You're probably getting bit by the broken GSSAPI library on OSX.  Try
> installing a supported library (MIT Kerberos or Heimdal).

Should we document somewhere that we consider that unsupported?
Trying it here, I see a bunch of "deprecation" warnings during
the build, but it does build --- which might lead people to expect
that it'd work.

            regards, tom lane

Greetings,

* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Stephen Frost <sfrost@snowman.net> writes:
> > * PG Bug reporting form (noreply@postgresql.org) wrote:
> >> Hello, i tried to uninstall and reinstall the Postgresql multiple times, but
> >> every time i go to enter my password, it gives me a GSSAPI error.
>
> > You're probably getting bit by the broken GSSAPI library on OSX.  Try
> > installing a supported library (MIT Kerberos or Heimdal).
>
> Should we document somewhere that we consider that unsupported?
> Trying it here, I see a bunch of "deprecation" warnings during
> the build, but it does build --- which might lead people to expect
> that it'd work.

There had been discussion on another thread about trying to figure out a
way to detect the OSX GSSAPI library and refuse to build with GSSAPI
support when that's what we'd be building against.  I didn't see anyone
post a patch though and I haven't got an OSX box to play with myself
easily at hand.

Thanks,

Stephen

Stephen Frost <sfrost@snowman.net> writes:
> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>> Should we document somewhere that we consider that unsupported?
>> Trying it here, I see a bunch of "deprecation" warnings during
>> the build, but it does build --- which might lead people to expect
>> that it'd work.

> There had been discussion on another thread about trying to figure out a
> way to detect the OSX GSSAPI library and refuse to build with GSSAPI
> support when that's what we'd be building against.  I didn't see anyone
> post a patch though and I haven't got an OSX box to play with myself
> easily at hand.

Just poking around, it looks like something along this line would work:

#ifdef GSSKRB_APPLE_DEPRECATED
#error "Postgres doesn't work with the macOS GSSAPI library, please use XXX instead."
#endif

(in any suitable spot after #including gssapi.h)

Now, this is testing the *headers* not the actual *library*, which in
some sense is not the right thing.  But it's probably close enough for
the purpose.

            regards, tom lane

Greetings,

* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Stephen Frost <sfrost@snowman.net> writes:
> > * Tom Lane (tgl@sss.pgh.pa.us) wrote:
> >> Should we document somewhere that we consider that unsupported?
> >> Trying it here, I see a bunch of "deprecation" warnings during
> >> the build, but it does build --- which might lead people to expect
> >> that it'd work.
>
> > There had been discussion on another thread about trying to figure out a
> > way to detect the OSX GSSAPI library and refuse to build with GSSAPI
> > support when that's what we'd be building against.  I didn't see anyone
> > post a patch though and I haven't got an OSX box to play with myself
> > easily at hand.
>
> Just poking around, it looks like something along this line would work:
>
> #ifdef GSSKRB_APPLE_DEPRECATED
> #error "Postgres doesn't work with the macOS GSSAPI library, please use XXX instead."
> #endif
>
> (in any suitable spot after #including gssapi.h)
>
> Now, this is testing the *headers* not the actual *library*, which in
> some sense is not the right thing.  But it's probably close enough for
> the purpose.

Sounds good to me.

Thanks,

Stephen