Skip site navigation (1) Skip section navigation (2)

SSPI client authentication in non-Windows builds

From: Christian Ullrich <chris(at)chrullrich(dot)net>
To: pgsql-hackers(at)postgresql(dot)org
Subject: SSPI client authentication in non-Windows builds
Date: 2011-01-03 13:11:37
Message-ID: ifshua$65t$1@dough.gmane.org (view raw or flat)
Thread:
Lists: pgsql-hackers
Hello all,

this patch adds support for connecting to servers running on Windows
and requesting SSPI authentication. It does this by treating
AUTH_REQ_SSPI the same as AUTH_REQ_GSS if no native SSPI support is
available.

In addition to being generally useful, this is a workaround to a 
problem with MIT KfW that I encountered back in September 2010 [1].

This change has been tested and works correctly on FreeBSD 8.1, using
the Kerberos and GSSAPI libraries from Heimdal 1.4. The server is
running PostgreSQL 9.0.2 on Windows 2008.

I originally fixed only the JDBC driver in this way [2], but then I
thought that I might try applying the same logic to libpq as well.

The preprocessor logic in that part of fe_sendauth() is quite
impenetrable; I hope I have not broken everything else.


[1] <http://archives.postgresql.org/message-id/i6cpc2%24m3h%241%40dough.gmane.org>
[2] <http://archives.postgresql.org/message-id/i6org1%24mup%241%40dough.gmane.org>


*** src/interfaces/libpq/fe-auth.c.orig	Mon Jan  3 13:33:32 2011
--- src/interfaces/libpq/fe-auth.c	Mon Jan  3 13:34:41 2011
***************
*** 831,836 ****
--- 831,839 ----
  
  #if defined(ENABLE_GSS) || defined(ENABLE_SSPI)
  		case AUTH_REQ_GSS:
+ #if defined(ENABLE_GSS) && !defined(ENABLE_SSPI)
+ 		case AUTH_REQ_SSPI:
+ #endif
  			{
  				int			r;
  
***************
*** 891,896 ****
--- 894,902 ----
  #else
  		case AUTH_REQ_GSS:
  		case AUTH_REQ_GSS_CONT:
+ #ifndef ENABLE_SSPI
+ 		case AUTH_REQ_SSPI:
+ #endif
  			printfPQExpBuffer(&conn->errorMessage,
  					 libpq_gettext("GSSAPI authentication not supported\n"));
  			return STATUS_ERROR;
***************
*** 913,923 ****
  			}
  			pgunlock_thread();
  			break;
- #else
- 		case AUTH_REQ_SSPI:
- 			printfPQExpBuffer(&conn->errorMessage,
- 					   libpq_gettext("SSPI authentication not supported\n"));
- 			return STATUS_ERROR;
  #endif
  
  
--- 919,924 ----


Responses

pgsql-hackers by date

Next:From: Heikki LinnakangasDate: 2011-01-03 13:12:10
Subject: Re: Re: new patch of MERGE (merge_204) & a question about duplicated ctid
Previous:From: JotaCommDate: 2011-01-03 12:54:31
Subject: Re: Problems with autovacuum and vacuum

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group