Re: BUG #16064: Ldap Authentication failing with pg_hba.conf entry

From: Stephen Frost <sfrost(at)snowman(dot)net>
To: k(dot)yudhveer(at)gmail(dot)com, pgsql-bugs(at)lists(dot)postgresql(dot)org
Subject: Re: BUG #16064: Ldap Authentication failing with pg_hba.conf entry
Date: 2019-10-17 21:54:43
Views: Raw Message | Whole Thread | Download mbox | Resend email
Lists: pgsql-bugs


* PG Bug reporting form (noreply(at)postgresql(dot)org) wrote:
> Can any one please guide me what is the issue with my ldap authentication on
> Postgresql 10.10. Here is the Entry for ldap in pg_hba.conf file
> host all all XX.XX.XXX.XX/32 ldap
> ldapserver=XX.XX.XXX.XX ldapbasedn="ou=People,dc=internal,dc=com"
> ldapbinddn="cn=Tom,ou=People,dc=internal,dc=com" ldapbindpasswd="Test123#"
> ldapport=389
> I created the same user "Tom" in the Postgres database too . Also created
> the User "Tom" other user "svc-ldap" in active directory too.
> When I am trying to connect to PostgreSQL server from other remote server,
> the authentication is failing with
> psql: FATAL: no pg_hba.conf entry for host "XXX.XX.XXX.XXX", user "Tom",
> database "Tom", SSL off

Unfortunately, you haven't provided what the specific IP addresses are,
but it looks like perhaps they don't match...? Note that when you
specify a '/32', the IP address in the pg_hba.conf must match EXACTLY
the IP address that the connection attempt is coming from.

All that said, you mention that you're using Active Directory, which
itself actually uses Kerberos for authentication- not LDAP, and
PostgreSQL directly supports Kerberos authentication through GSSAPI. I
strongly encourage you to look into use GSSAPI instead, it's much more
secure than using LDAP-based auth and avoids the user's password being
sent to the PostgreSQL server (where it could be compromised if the PG
process is compromised).



In response to

Browse pgsql-bugs by date

  From Date Subject
Next Message Jeff Janes 2019-10-17 23:16:32 Re: BUG #16064: Ldap Authentication failing with pg_hba.conf entry
Previous Message Robert Henry 2019-10-17 19:08:58 postgres has no spinlock support on riscv rv64imafdc