Can postgres be configure for GSS/Kerberos authentication without a keyfile?

From: Eric(dot)Kamradt <Eric(dot)Kamradt(at)accessdevelopment(dot)com>
To: "pgsql-general(at)postgresql(dot)org" <pgsql-general(at)postgresql(dot)org>
Subject: Can postgres be configure for GSS/Kerberos authentication without a keyfile?
Date: 2012-04-04 15:27:46
Message-ID: 69B02B0156C03149BEF10F9500AE73C908EF7109@EXCH02.memberweb.accessdevelopment.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

Can postgres be configure for GSS/Kerberos authentication without a keyfile?

I have Kerberos working
I compiled postgres with -with-gssapi
I've setup the pg_hba.conf with gss and my IP address
I'm not sure what to put in the postgres.conf

I can do a kinit buckwheat(dot)johnson(at)SOME_EXAMPLE(dot)COM<mailto:buckwheat(dot)johnson(at)SOME_EXAMPLE(dot)COM> - and it correctly validates against an AD server
My klist is as follows
-------------------------------------------
[root(at)mbr01 postgresql-9.1.3]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: buckwheat(dot)johnson(at)SOME_EXAMPLE(dot)COM

Valid starting Expires Service principal
04/04/12 08:41:28 04/04/12 15:21:28 krbtgt/SOME_EXAMPLE(dot)COM(at)SOME_EXAMPLE(dot)COM

Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached
-----------------------------------------------------

I'm getting a error on the Linus CentOS server side
FATAL: GSSAPI authentication failed for user "buckwheat.johnson"

The error I'm getting on my windoz client is
psql: SSPI continuation error: The specified target is unknown or unreachable
(80090303)

Do I have to set the "krb_server_keyfile" in the postgres.conf? If not do I have to set any krb5 postgres.conf parameters?

--
Eric (alias buckwheat)

CONFIDENTIALITY: This email (including any attachments) may contain confidential, proprietary
and privileged information, and unauthorized disclosure or use is prohibited. If you received this
email in error, please notify the sender and delete this email from your system.
Thank you

Browse pgsql-general by date

  From Date Subject
Next Message Tom Lane 2012-04-04 15:31:33 Re:
Previous Message Michael Nolan 2012-04-04 15:18:26 Re: Fwd: [GENERAL] 9.1.3: launching streaming replication