Re: Does psycopg2 support Kerberos for Postgres?

Hi, Adrian,

Thanks for the reply.

The Postgres server is Kerberos enabled, as I can log in using either psql CLI, or pyodbc lib, or pg_admin client UI without password.

With the bare bone code as below, when I run against the localhost, I am able to log in. However, it fails if it's the remote host. The error says GSSAPI authentication not supported as below.
Please advise.

Thank you.

Yang
----

Traceback (most recent call last):
File "/home/yangg/IdeaProjects/PyPlayground/psycopg2_test.py", line 15, in <module>
conn = psycopg2.connect(conn_string)
File "/home/yangg/.conda/envs/py2/lib/python2.7/site-packages/psycopg2/__init__.py", line 164, in connect
conn = _connect(dsn, connection_factory=connection_factory, async=async)
psycopg2.OperationalError: GSSAPI authentication not supported

----

from pprint import pprint as p
import psycopg2
import os

conn_string = "host='remote_host_XXX' dbname='table_YYY'"
conn = psycopg2.connect(conn_string)
cursor = conn.cursor()
cursor.execute("SELECT version()")
records = cursor.fetchall()
p(records)

----
-----Original Message-----
From: Adrian Klaver [mailto:adrian(dot)klaver(at)aklaver(dot)com]
Sent: Saturday, December 03, 2016 5:53 PM
To: Yang Gao; 'psycopg(at)postgresql(dot)org'
Subject: Re: [psycopg] Does psycopg2 support Kerberos for Postgres?

On 12/02/2016 10:46 AM, Yang Gao wrote:
> Dear Psycopg Dev,
>
>
>
> Not sure if this is the right channel but thought to give it a try anyway.
>
>
>
> This is Yang Gao from Two Sigma. We are trying to use your driver
> along with SqlAlchemy to access a Postgres DB with Kerberos support
> and failed to make it work. We have done quite some googling but found
> almost not relevant info. The driver does not seem to recognize the
> "krbsrvname" or "gsslib" param suggested by Postgres doc.
>
>
>
> We were wondering if Kerberos is supported at all by the driver? And
> if yes, is there any documentation or example?

Second question. Was your Postgres database built with the proper support?:

https://www.postgresql.org/docs/9.5/static/auth-methods.html

GSSAPI is an industry-standard protocol for secure authentication defined in RFC 2743. PostgreSQL supports GSSAPI with Kerberos authentication according to RFC 1964. GSSAPI provides automatic authentication (single sign-on) for systems that support it. The authentication itself is secure, but the data sent over the database connection will be sent unencrypted unless SSL is used.

GSSAPI support has to be enabled when PostgreSQL is built; see Chapter
15 for more information.

>
>
>
> Thank you very much.
>
>
>
> Yang
>
>
>

--
Adrian Klaver
adrian(dot)klaver(at)aklaver(dot)com