|
Hi Andre,
Thank for the followup. Here are the tests and results:
I've deleted and created service user postgres in lower case on the AD, and I've made this command.
ktpass -out postgres.keytab -princ postgres/UBUNTU.ad.corp.com@xxxxxxxxxxx -mapUser AD\postgres -pass 'postgres' -mapOp add -crypto ALL -ptype KRB5_NT_PRINCIPAL
Changed pg_hba.conf to
host all all 0.0.0.0/0 gss gss include_realm=0 [http://krb_realm%3Dad.corp.com/]krb_realm=AD.CORP.COM
kinit is working
kinit ubuntupg(at)AD(dot)CORP(dot)COM
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: ubuntupg@xxxxxxxxxxx
Valid starting Expires Service principal
2019-03-01 10:21:50 2019-03-01 20:21:50 krbtgt/AD.CORP.COM@xxxxxxxxxxx
renew until 2019-03-08 10:21:43
Here are the bad:
root@UBUNTU:~# psql -h 192.168.20.143 -U ubuntupg
psql: erreur de suite GSSAPI: Unspecified GSS failure. Minor code may provide more information
erreur de suite GSSAPI: No Kerberos credentials available
Postgresql log
2019-03-01 09:59:13.890 EST [8913] postgres@postgres
LOG: 00000: connection authorized: user=postgres database=postgres
2019-03-01 09:59:13.890 EST [8913] postgres@postgres LOCATION: PerformAuthentication, postinit.c:272
2019-03-01 09:59:18.992 EST [8942] [unknown]@[unknown] LOG: 00000: connection received: host=192.168.20.143 port=40024
2019-03-01 09:59:18.992 EST [8942] [unknown]@[unknown] LOCATION: BackendInitialize, postmaster.c:4188
2019-03-01 09:59:19.000 EST [8942] ubuntupg@ubuntupg FATAL: 28000: GSSAPI authentication failed for user "ubuntupg"
2019-03-01 09:59:19.000 EST [8942] ubuntupg@ubuntupg DETAIL: Connection matched pg_hba.conf line 96: "host all all 0.0.0.0/0 gss include_realm=0 krb_realm=AD.CORP.COM"
2019-03-01 09:59:19.000 EST [8942] ubuntupg@ubuntupg LOCATION: auth_failed, auth.c:307
User ubuntupg is created on the AD. In
postgresql, does it need to have a naming convention? At this moment, i've a user named ubuntupg and also ubuntupg@xxxxxxxxxxx
> I
think setting up PAM authentication with AD on Linux server joined to
> domain via realm SSSD was much easier and transparent.
I
don't know this kind of authentication, do you have more information on this? Maybe I can switch authentication method.
Best regards,
De : Andre Piwoni <apiwoni@xxxxxxxxx>
Envoyé : 28 février 2019 20:19 À : Jean-Philippe Chenel Cc : pgsql-general@xxxxxxxxxxxxxxxxxxxx Objet : Re: PostgreSQL (linux) configuration with GSSAPI to a Windows domain I think setting up PAM authentication with AD on Linux server joined to domain via realm SSSD was much easier and transparent.
Something like this worked for me to create SPN mapping and keytab in one command without need to use UPPERCASE for POSTGRES:
ktpass -out postgres.keytab -princ POSTGRES/UBUNTU.ad.corp.com@xxxxxxxxxxx -mapUser AD\POSTGRES -pass 'thepassword' -mapOp add -crypto ALL -ptype KRB5_NT_PRINCIPAL
pg_hba.conf
host all all 0.0.0.0/0 gss gss include_realm=0 krb_realm=AD.CORP.COM
ktb_realm should not be needed since you have one in your krb5.conf
postgresql.conf
krb_server_keyfile = '/etc/postgresql/9.6/main/postgres.keytab'
#krb_caseins_users = off
kinit ubuntupg@xxxxxxxxxxx
psql.exe -h 192.168.1.143 -U ubuntupg
klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: ubuntupg@xxxxxxxxxxx
Valid starting Expires Service principal
08/03/2018 22:28:47 08/04/2018 08:28:47 krbtgt/AD.CORP.COM@xxxxxxxxxxx
renew until 08/10/2018 22:28:42
08/03/2018 22:29:00 08/04/2018 08:28:47 POSTGRES/UBUNTU.ad.corp.com@xxxxxxxxxxx
renew until 08/10/2018 22:28:42
On Thu, Feb 28, 2019 at 2:54 PM Jean-Philippe Chenel <jp.chenel@xxxxxxx> wrote:
|
