Re: Windows SIngle Sign On - LINUX Server

On Fri, Aug 24, 2012 at 1:29 PM, Jeremy Palmer <JPalmer(at)linz(dot)govt(dot)nz> wrote:

> Marcus' guide looks great.
>
> So what's the pros/cons of using the Kerberos via GSSAPI method, rather
> than going for the SingleSignOn method mentioned by Sunday?
>
> Cons:

More complicated to set up.

There are a few odd things about AD and Kerberos that take some getting
used to. For example iirc, systems get keys rather than services, so your
keytab ends up showing identical keys for every service on a machine

Pros:

Far more secure

True single-sign-on (users do not have to enter passwords).

Unlike LDAP does not require degrading DC security.

I would honestly go with GSSAPI.

It's not quite the same thing but a paper I wrote (published by Microsoft!)
is likely to be helpful here:

http://blogs.technet.com/b/port25/archive/2008/06/06/technical-analysis-openssh-on-linux-using-windows-kerberos-for-authentication.aspx

The paper discusses using kerberized authentication for OpenSSH against AD.
In principle, PostgreSQL should be relatively similar. The paper may be
of help here.

Best Wishes,
Chris Travers