Re: pg16 && GSSAPI && Heimdal/Macos

On Wed, Dec 06, 2023 at 10:57:15PM -0500, Tom Lane wrote:
> The immediate reason for dropping that support is that Heimdal doesn't
> have gss_store_cred_into(), without which we can't support delegated
> credentials. AFAICT, Apple's version doesn't have that either.
> We could argue about how important that feature is and whether it'd be
> okay to have an Apple-only build option to not have it. However...

Heimdal in the master branch sure does; I'm the author if
gss_store_cred_into() and gss_store_cred_into2(). Idk when we'll do an
8.0 release though. We've run out of steam. The reality is that the
world needs PostgreSQL to support OAuth w/ JWT more than the world needs
Kerberos or Heimdal's implementation of it.

> ... there's another good reason to shy away from relying on Apple's
> library, which is that they've conspicuously marked all the standard
> Kerberos functions as deprecated. It's not clear if that means
> they're planning to remove them outright, but surely it's an indicator
> that Apple doesn't want outside code calling them.

The krb5 API is horrible. Do not use it if you can avoid it. The
GSS-API is better, mostly.

Nico
--