Re: pg16 && GSSAPI && Heimdal/Macos

"Todd M. Kover" <kovert(at)omniscient(dot)com> writes:
> Wehere did this end up getting decided? I'm hoping, if it's going to
> make it into main/master, it will be able to also make it's way ingo pg18.

I don't think anything's been decided. I've expressed my opinion,
but I'm just one person. I'd hoped some other people who are
interested in Postgres security matters would comment.

Even granting that we're okay with letting people build against
Heimdal, I'm not clear on the path forward. Your patch proposes
to effectively disable gss_accept_delegation, which isn't real
palatable (and would require docs and test fixes that aren't there).
Nico seemed to think that there is a way to perform delegation
without using gss_store_cred_into; if we could avoid that loss of
functionality, it'd go a long way towards making the idea more
acceptable. I also wonder about whether we ought to try to use
GSS.framework on Mac.

I can say though that it's definitively too late for v18; we've been
in feature freeze for months.

regards, tom lane