Re: GSSAPI / Kerberos Authentication

All,

* Bear Giles (bgiles(at)coyotesong(dot)com) wrote:
> I remember reading comments in the code that case matters - postgres and
> POSTGRES are not the same - but I'm drawing a blank on the rest. I just
> started looking at the code myself though - others probably have more
> experience.

That's correct, case absolutely matters and it needs to match.

There are options in postgresql.conf to control what's expected. This
is a source of common issue when coming from Windows clients to Linux
servers (or the other way around).

In particular, review section 19.3.3 of the 9.5 docs:

https://www.postgresql.org/docs/9.5/static/auth-methods.html#GSSAPI-AUTH

For the client side, review krbsrvname:

https://www.postgresql.org/docs/9.5/static/libpq-connect.html#LIBPQ-PARAMKEYWORDS

Check the klist from the client side and also look at the keytab that's
on the server and what's in the KDC database and make sure they all
match. What the client asks for from the KDC needs to be what the KDC
has and what is installed in the keytab on the server for it all to
work.

Thanks!

Stephen