Re: Does psycopg2 support Kerberos for Postgres?

On 12/06/2016 07:41 AM, Yang Gao wrote:
> Yes, we are trying to use sqlAlchemy over psycopg2. However, my experiments have been on standalone psycopg2. Because I was working back and forth, I took the wrong connection string.

I have to apologize. I was going back over the thread to see if I missed
anything and I found you did mention using SLQAlchemy in your first post.

> Here's the exact string that I'm using in stand-alone psycopg2:
>
> 1. conn_string = "host=fqdn_hostname' dbname='dbname' krbsrvname='postgres'"
> or
> 2. conn_string = "host=fqdn_hostname' dbname='dbname'"
>
> The 1 gives the error of: psycopg2.OperationalError: invalid connection option "krbsrvname"
> The 2 gives the error of: psycopg2.OperationalError: GSSAPI authentication not supported

This is to the remote host, correct?

Also what are the pg_hba.conf entries for the local and remote hosts?

Where does your libpq come from?

>
> Sorry for the earlier confusion.
>
> Thanks.
>
> Yang
>
>
>
> -----Original Message-----
> From: Adrian Klaver [mailto:adrian(dot)klaver(at)aklaver(dot)com]
> Sent: Tuesday, December 06, 2016 10:32 AM
> To: Yang Gao; 'psycopg(at)postgresql(dot)org'
> Subject: Re: [psycopg] Does psycopg2 support Kerberos for Postgres?
>
> On 12/06/2016 07:20 AM, Yang Gao wrote:
>> You are most likely correct about local log in.
>>
>> This is the string that I'm using:
>> sqlalchemy.create_engine("postgresql+psycopg2://fqdn_of_host/db_name")
>> I tried adding "? krbsrvname=postgres" at the end as well, but got the error aforementioned.
>
> It would have been nice to know you where using SQLAlchemy above
> psycopg2 at the beginning of this conversation.
>
> So again can you show the actual complete string you are using?
>
> Not sure if this a cut and paste error but you have:
>
> ? krbsrvname=postgres
>
> Pretty sure the space between ? and krbsrvname is not good.
>
> Also what happens if you bypass SQLAlchemy and try to connect using
> psycopg2 directly?
>
>
>>
>> Thanks.
>>
>> Yang
>>
>>
>
>
>

--
Adrian Klaver
adrian(dot)klaver(at)aklaver(dot)com