database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-28 23:42:10 +03:00
Code Activity

Add authentication parameters compat_realm and upn_usename for SSPI

Browse Source 
These parameters are available for SSPI authentication only, to make
it possible to make it behave more like "normal gssapi", while
making it possible to maintain compatibility.

compat_realm is on by default, but can be turned off to make the
authentication use the full Kerberos realm instead of the NetBIOS name.

upn_username is off by default, and can be turned on to return the users
Kerberos UPN rather than the SAM-compatible name (a user in Active
Directory can have both a legacy SAM-compatible username and a new
Kerberos one. Normally they are the same, but not always)

Author: Christian Ullrich
Reviewed by: Robbie Harwood, Alvaro Herrera, me
This commit is contained in:
Magnus Hagander
2016-04-08 20:23:52 +02:00
parent cb0c8cbf31
commit 35e2e357cb
4 changed files with 178 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
doc/src/sgml/client-auth.sgml
View File

@ -1106,6 +1106,43 @@ omicron bryanh guest1
</listitem>
</varlistentry>
<varlistentry>
<term><literal>compat_realm</literal></term>
<listitem>
<para>
If set to 1, the domain's SAM-compatible name (also known as the
NetBIOS name) is used for the <literal>include_realm</literal>
option. This is the default. If set to 0, the true realm name from
the Kerberos user principal name is used.
</para>
<para>
Do not enable this option unless your server runs under a domain
account (this includes virtual service accounts on a domain member
system) and all clients authenticating through SSPI are also using
domain accounts, or authentication will fail.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><literal>upn_username</literal></term>
<listitem>
<para>
If this option is enabled along with <literal>compat_realm</literal>,
the user name from the Kerberos UPN is used for authentication. If
it is disabled (the default), the SAM-compatible user name is used.
By default, these two names are identical for new user accounts.
</para>
<para>
Note that <application>libpq</> uses the SAM-compatible name if no
explicit user name is specified. If you use
<application>libpq</> or a driver based on it, you should
leave this option disabled or explicitly specify user name in the
connection string.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><literal>map</literal></term>
<listitem>