Preliminary support for SSPI authentication on Windows

From: Craig Ringer <craig(at)2ndquadrant(dot)com>
To: PG-JDBC Mailing List <pgsql-jdbc(at)postgresql(dot)org>
Subject: Preliminary support for SSPI authentication on Windows
Date: 2014-10-09 03:40:12
Message-ID: 5436039C.7090309@2ndquadrant.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-jdbc

Hi all

I've implemented PgJDBC SSPI support for Windows clients for a customer
and would like to merge it into PgJDBC.

I now have a PgJDBC patch that permits passwordless, secure
single-sign-on from a JVM running on a Windows client to a PostgreSQL
server running on a Windows server that has domain-trust for the client.

Under the hood Windows does it with Kerberos (for networked domain
authentication) or NTLM (for loopback on standalone hosts) but we don't
have to care. We just broker the SSPI messaging between client and
server until the servers confirms successful authentication.

I've written it up a bit in https://github.com/pgjdbc/pgjdbc/issues/202 .

There's some cleanup work to do before merging though, and I'd
appreciate a few comments. I've added details to the github issue,
mainly around dependency fetching/management and backward compatibility.

Your input would be welcomed.

--
Craig Ringer http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services

Browse pgsql-jdbc by date

  From Date Subject
Next Message Swapna Shetty 2014-10-09 14:22:49 Re: Network error
Previous Message Craig Ringer 2014-10-09 02:32:58 Re: Disk buffering of resultsets