Re: [HACKERS] Kerberos brokenness and oops question in 8.1beta2

From: "Magnus Hagander" <mha(at)sollentuna(dot)net>
To: "Bruce Momjian" <pgman(at)candle(dot)pha(dot)pa(dot)us>, "Tom Lane" <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Cc: "PostgreSQL-patches" <pgsql-patches(at)postgresql(dot)org>, <kovert(at)omniscient(dot)com>
Subject: Re: [HACKERS] Kerberos brokenness and oops question in 8.1beta2
Date: 2005-10-15 14:35:40
Message-ID: 6BCB9D8A16AC4241919521715F4D8BCE92E73E@algol.sollentuna.se
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-patches

> Now, our code has been modified since his patch was applied,
> but we now
> have:
>
> /*
> * If no hostname was specified, pg_krb_server_hostname is already
> * NULL. If it's set to blank, force it to NULL.
> */
> khostname = pg_krb_server_hostname;
> if (khostname && khostname[0] == '\0')
> khostname = NULL;
>
> retval = krb5_sname_to_principal(pg_krb5_context,
> khostname,
> pg_krb_srvnam,
> KRB5_NT_SRV_HST,
> &pg_krb5_server);
>
> The basic affect is if the GUC krb_server_hostname is empty/NULL,
> krb5_sname_to_principal() gets called with a 2nd argument
> (hostname) of NULL. The documentation for this function says
> for this argument:

Yup, that's correct it's the new behaviour.

> http://publib.boulder.ibm.com/iseries/v5r1/ic2924/index.htm?in
> fo/apis/krb5list.htm
>
> hostname (Input)
>
> The host containing the desired service instance. The
> local host is used
> if NULL is specified for this parameter.
>
> Which says it doesn't accept any service entry in keytab, but
> rather binds the server hostname to 'localhost'. I think
> this is why it wasn't working for Magnus.

No. This is how it is now, after Tom applied my patch. It now works just
fine for me.

Previously, we set pg_krb5_server to NULL, which is something completely
different than pg_krb_srvname=NULL (yes, they are named very closely,
but they are completely different things). krb5_sname_to_principal()
was never called.

This is what wasn't working for me.

> I have applied the following patch which updates the
> documentation to reflect 'localhost', and improves the error
> message to always print the server name as well as the
> service name. (We have had complaints about poor Kerberos
> error messages before.)

This is not correct.
The default is *not* "localhost". It's the "local host name". As in
what's returned by gethostname().

//Magnus

Responses

Browse pgsql-patches by date

  From Date Subject
Next Message Bruce Momjian 2005-10-15 15:29:50 Re: [HACKERS] Kerberos brokenness and oops question in 8.1beta2
Previous Message Michael Fuhr 2005-10-14 23:38:55 Re: Documentation typos