Thread: BUG #17740: Connecting postgresql 13 with different psql versions

The following bug has been logged on the website:

Bug reference:      17740
Logged by:          Anbu
Email address:      gopi.anbumech@gmail.com
PostgreSQL version: 13.8
Operating system:   linux
Description:

For GSSAPI Kerberos external authenticated connections, it appears that psql
v13 is not honouring order of the rules specified in pg_hba.conf. Will there
be any difference in way/options with which psql binary has been built ?

With following entries in pg_hba.conf, psql v13 is prompting for password
for Kerberos connections, whereas psql v11 succeeds connecting without any
issue.

local all pgbkp peer map=pgbackrest
hostssl all +citi_pg_app_read 0.0.0.0/0 gss map=krb
host all all 0.0.0.0/0 scram-sha-256

[kdc_test_fid@icl-actpsql-vm1 /psql13]$ psql -U app_kdc_test_fid -h x.x.x -d
postgres -p 1524
Password for user app_kdc_test_fid:

[kdc_test_fid@icl-actpsql-vm1 /psql11]$ psql -U app_kdc_test_fid -h x.x.x -d
postgres -p 1524
psql (11.13, server 13.8)
WARNING: psql major version 11, server major version 13.
Some psql features might not work.
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384,
bits: 256, compression: off)
Type "help" for help.
postgres=>

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

But as soon as the this line is commented out in pg_hba.conf, GSSAPI
Kerberos external authenticated connection succeeds for both psql V13 and
v11.
#host all all 0.0.0.0/0 scram-sha-256

[kdc_test_fid@icl-actpsql-vm1 /psql13]$ psql -U app_kdc_test_fid -h x.x.x -d
postgres -p 1524
psql (13.8)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits:
256, compression: off)
Type "help" for help.
postgres=>

[kdc_test_fid@icl-actpsql-vm1 /psql11]$ psql -U app_kdc_test_fid -h x.x.x -d
postgres -p 1524
psql (11.13, server 13.8)
WARNING: psql major version 11, server major version 13.
Some psql features might not work.
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384,
bits: 256, compression: off)
Type "help" for help.
postgres=>

Note: app_kdc_test_fid user is part of defined group in hba rules.

PG Bug reporting form <noreply@postgresql.org> writes:
> With following entries in pg_hba.conf, psql v13 is prompting for password
> for Kerberos connections, whereas psql v11 succeeds connecting without any
> issue.

> local all pgbkp peer map=pgbackrest
> hostssl all +citi_pg_app_read 0.0.0.0/0 gss map=krb
> host all all 0.0.0.0/0 scram-sha-256

> [kdc_test_fid@icl-actpsql-vm1 /psql13]$ psql -U app_kdc_test_fid -h x.x.x -d
> postgres -p 1524
> Password for user app_kdc_test_fid:

I suspect the v13 libpq is trying GSSAPI encryption before SSL encryption,
so it falls through the hostssl line and ends up at the catchall.

            regards, tom lane

Anbazhagan M <gopi.anbumech@gmail.com> writes:
> Any workaround is there for this to make it work as it was when pg 13 was
> connected with psql v11?

You could add a hostgssenc line specifying what you want the server
to do with that --- maybe just "hostgssenc ... reject" if you don't
want to think hard about it.

            regards, tom lane

Anbazhagan M <gopi.anbumech@gmail.com> writes:
> If psql v11 is behaving in a right way, what difference made psql v13 to
> behave in a different way ? Was there any changes done between versions of
> psql v11 and v13 ?

I told you already: I think the relevant difference is the addition of GSS
(i.e. Kerberos or equivalent) support starting in v12.  Both versions are
behaving correctly according to their own feature sets.  What is missing
is that you need to update your pg_hba.conf to account for the possibility
of GSS-encrypted connections.

            regards, tom lane