Re: GSS Authentication

* Bryan Montgomery (monty(at)english(dot)net) wrote:
> I've been trying this as well off and on. In my case I'm not convinced the
> AD configuration is correct (And someone else manages that).

Yeah, that can be a challenge.. but it's *definitely* possible to get
it set up and working correctly.

> Can you use kinit with the key tab options to get a good response from the
> server? I think I should be able to do this ..
> $ kinit -V -k -t poe3b.keytab HTTP/poe3b.lab2k.net
> kinit(v5): Preauthentication failed while getting initial credentials

err, I'm not sure that should be expected to work.

What does klist -ek <keytab file> return? Also, you should be able to
kinit to *your* princ in the AD, and if you can do that, you should be
able to use your princ to request the service princ ticket from the KDC
by doing kinit -S HTTP/poe3b.lab2k.net your.princ

Also, provided your *client* is set up/configured correctly, you should
be able to see that it acquires the ticket (by using klist) when you try
to connect to the server, even if the server is misconfigured.

> I'd be interested to know if you get something different - and the steps you
> went through on the AD side.

You have to create an account in Active Directory for the PG service and
then use:

ktpass /princ POSTGRES/myserver(dot)mydomain(dot)com(at)MYDOMAIN(dot)COM /mapuser
postgres(at)mydomain(dot)com /pass mypass /crypto AES256-SHA1 /ptype
KRB5_NT_PRINCIPAL /out krb5.keytab

Then copy that krb5.keytab to the server. Note that you then have to
adjust the server config to have service name set to POSTGRES, and
adjust clients using the environment variables to indiciate they should
ask for POSTGRES (instead of the postgres default).

Thanks,

Stephen