* John McCawley (nospam@xxxxxxxxxxxx) wrote: > (I am working on this project with Derrick.) We have to use the Active > Directory to authenticate not only users from our client-side app (We're > attempting to use PostgreSQL essentially as a proxy authentication > mechanism), but also for connections to the SFTP server, and finally our > web app. Rather than doing three separate binding mechanisms, we wanted > to do the PAM/AD work once, and then have everything else defer to PAM > for authentication. Have you considered using Kerberos to auth against AD instead of trying to use LDAP binding? If you still want to use PAM then you might check out libpam-krb5, which from a bit of googling appears to work w/ AD Kerberos. Of course, an alternative might be to try using the native Kerberos support in Postgres which I've heard may work w/ the Postgres ODBC driver... Personally, I've gotten the Postgres ODBC driver working under windows with MIT Kerberos and I've gotten Firefox under Windows working w/ MIT Kerberos and using negotiate with Apache2 to authenticate users of PhpPgAdmin to Postgres. I'm pretty sure all of this is possible with AD instead of MIT Kerberos, or possibly even through a cross-realm setup. Thanks, Stephen > Magnus Hagander wrote: > > >On Tue, Dec 19, 2006 at 09:52:58AM -0600, Derrick Stensrud wrote: > > > > > >>Thanks I've been trying to use pam_ldap but I keep getting this error > >>from postgres. I think it may have something to do with postgres > >>running as the postgres user and not having permissions to something, > >>but I have no idea what. > >> > >> > > > >Probably. Can you try the native LDAP authentication? If not, I'll have > >to defer to someone who knows PAM. > > > >//Magnus > > > >---------------------------(end of broadcast)--------------------------- > >TIP 6: explain analyze is your friend > > > > > > ---------------------------(end of broadcast)--------------------------- > TIP 9: In versions below 8.0, the planner will ignore your desire to > choose an index scan if your joining column's datatypes do not > match
Attachment:
signature.asc
Description: Digital signature
