Skip to content

Commit 1f9f6aa

Browse files
tglsfdctglsfdc
committed
Spell the values of libpq's gssdelegation parameter as "0" and "1".
That's how other boolean options are handled, so do likewise. The previous coding with "enable" and "disable" was seemingly modeled on gssencmode, but that's a three-way flag. While at it, add PGGSSDELEGATION to the set of environment variables cleared by pg_regress and Utils.pm. Abhijit Menon-Sen, per gripe from Alvaro Herrera Discussion: https://postgr.es/m/20230522091609.nlyuu4nolhycqs2p@alvherre.pgsql
1 parent 4123455 commit 1f9f6aa

File tree

9 files changed

+34
-31
lines changed

9 files changed

+34
-31
lines changed

‎doc/src/sgml/libpq.sgml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2059,9 +2059,9 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
20592059
<listitem>
20602060
<para>
20612061
Forward (delegate) GSS credentials to the server. The default is
2062-
<literal>disable</literal> which means credentials will not be forwarded
2063-
to the server. Set this to <literal>enable</literal> to have
2064-
credentials forwarded when possible.
2062+
<literal>0</literal> which means credentials will not be forwarded
2063+
to the server. Set this to <literal>1</literal> to have credentials
2064+
forwarded when possible.
20652065
</para>
20662066
</listitem>
20672067
</varlistentry>

‎doc/src/sgml/release-16.sgml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -953,7 +953,8 @@ Add support for Kerberos credential delegation (Stephen Frost)
953953
</para>
954954

955955
<para>
956-
This is enabled with server variable gss_accept_delegation.
956+
This is enabled with server variable gss_accept_delegation
957+
and libpq connection parameter gssdelegation.
957958
</para>
958959
</listitem>
959960

‎src/interfaces/libpq/fe-auth.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ pg_GSS_continue(PGconn *conn, int payloadlen)
9797
if (!pg_GSS_have_cred_cache(&conn->gcred))
9898
conn->gcred = GSS_C_NO_CREDENTIAL;
9999

100-
if (conn->gssdelegation && pg_strcasecmp(conn->gssdelegation, "enable") == 0)
100+
if (conn->gssdelegation && conn->gssdelegation[0] == '1')
101101
gss_flags |= GSS_C_DELEG_FLAG;
102102

103103
maj_stat = gss_init_sec_context(&min_stat,

‎src/interfaces/libpq/fe-connect.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -343,8 +343,8 @@ static const internalPQconninfoOption PQconninfoOptions[] = {
343343
"GSS-library", "", 7, /* sizeof("gssapi") == 7 */
344344
offsetof(struct pg_conn, gsslib)},
345345

346-
{"gssdelegation", "PGGSSDELEGATION", NULL, NULL,
347-
"GSS-delegation", "", 8, /* sizeof("disable") == 8 */
346+
{"gssdelegation", "PGGSSDELEGATION", "0", NULL,
347+
"GSS-delegation", "", 1,
348348
offsetof(struct pg_conn, gssdelegation)},
349349

350350
{"replication", NULL, NULL, NULL,

‎src/interfaces/libpq/fe-secure-gssapi.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -622,7 +622,7 @@ pqsecure_open_gss(PGconn *conn)
622622
if (ret != STATUS_OK)
623623
return PGRES_POLLING_FAILED;
624624

625-
if (conn->gssdelegation && pg_strcasecmp(conn->gssdelegation, "enable") == 0)
625+
if (conn->gssdelegation && conn->gssdelegation[0] == '1')
626626
{
627627
/* Acquire credentials if possible */
628628
if (conn->gcred == GSS_C_NO_CREDENTIAL)

‎src/interfaces/libpq/libpq-int.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -404,7 +404,7 @@ struct pg_conn
404404
char *krbsrvname; /* Kerberos service name */
405405
char *gsslib; /* What GSS library to use ("gssapi" or
406406
* "sspi") */
407-
char *gssdelegation; /* Try to delegate GSS credentials? */
407+
char *gssdelegation; /* Try to delegate GSS credentials? (0 or 1) */
408408
char *ssl_min_protocol_version; /* minimum TLS protocol version */
409409
char *ssl_max_protocol_version; /* maximum TLS protocol version */
410410
char *target_session_attrs; /* desired session properties */

‎src/test/kerberos/t/001_auth.pl

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -381,7 +381,7 @@ sub test_query
381381
'test1',
382382
'SELECT gss_authenticated AND encrypted AND NOT credentials_delegated FROM pg_stat_gssapi WHERE pid = pg_backend_pid();',
383383
0,
384-
'gssencmode=prefer gssdelegation=enable',
384+
'gssencmode=prefer gssdelegation=1',
385385
'succeeds with GSS-encrypted access preferred with host hba and credentials not delegated even though asked for (ticket not forwardable)',
386386
"connection authenticated: identity=\"test1\@$realm\" method=gss",
387387
"connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, delegated_credentials=no, principal=test1\@$realm)"
@@ -391,7 +391,7 @@ sub test_query
391391
'test1',
392392
'SELECT gss_authenticated AND encrypted AND NOT credentials_delegated FROM pg_stat_gssapi WHERE pid = pg_backend_pid();',
393393
0,
394-
'gssencmode=require gssdelegation=enable',
394+
'gssencmode=require gssdelegation=1',
395395
'succeeds with GSS-encrypted access required with host hba and credentials not delegated even though asked for (ticket not forwardable)',
396396
"connection authenticated: identity=\"test1\@$realm\" method=gss",
397397
"connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, delegated_credentials=no, principal=test1\@$realm)"
@@ -480,7 +480,7 @@ sub test_query
480480
'test1',
481481
'SELECT gss_authenticated AND encrypted AND NOT credentials_delegated from pg_stat_gssapi where pid = pg_backend_pid();',
482482
0,
483-
'gssencmode=prefer gssdelegation=enable',
483+
'gssencmode=prefer gssdelegation=1',
484484
'succeeds with GSS-encrypted access preferred and hostgssenc hba and credentials not forwarded (server does not accept them, default)',
485485
"connection authenticated: identity=\"test1\@$realm\" method=gss",
486486
"connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, delegated_credentials=no, principal=test1\@$realm)"
@@ -490,7 +490,7 @@ sub test_query
490490
'test1',
491491
'SELECT gss_authenticated AND encrypted AND NOT credentials_delegated from pg_stat_gssapi where pid = pg_backend_pid();',
492492
0,
493-
'gssencmode=require gssdelegation=enable',
493+
'gssencmode=require gssdelegation=1',
494494
'succeeds with GSS-encrypted access required and hostgssenc hba and credentials not forwarded (server does not accept them, default)',
495495
"connection authenticated: identity=\"test1\@$realm\" method=gss",
496496
"connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, delegated_credentials=no, principal=test1\@$realm)"
@@ -504,7 +504,7 @@ sub test_query
504504
'test1',
505505
'SELECT gss_authenticated AND encrypted AND NOT credentials_delegated from pg_stat_gssapi where pid = pg_backend_pid();',
506506
0,
507-
'gssencmode=prefer gssdelegation=enable',
507+
'gssencmode=prefer gssdelegation=1',
508508
'succeeds with GSS-encrypted access preferred and hostgssenc hba and credentials not forwarded (server does not accept them, explicitly disabled)',
509509
"connection authenticated: identity=\"test1\@$realm\" method=gss",
510510
"connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, delegated_credentials=no, principal=test1\@$realm)"
@@ -514,7 +514,7 @@ sub test_query
514514
'test1',
515515
'SELECT gss_authenticated AND encrypted AND NOT credentials_delegated from pg_stat_gssapi where pid = pg_backend_pid();',
516516
0,
517-
'gssencmode=require gssdelegation=enable',
517+
'gssencmode=require gssdelegation=1',
518518
'succeeds with GSS-encrypted access required and hostgssenc hba and credentials not forwarded (server does not accept them, explicitly disabled)',
519519
"connection authenticated: identity=\"test1\@$realm\" method=gss",
520520
"connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, delegated_credentials=no, principal=test1\@$realm)"
@@ -528,7 +528,7 @@ sub test_query
528528
'test1',
529529
'SELECT gss_authenticated AND encrypted AND credentials_delegated from pg_stat_gssapi where pid = pg_backend_pid();',
530530
0,
531-
'gssencmode=prefer gssdelegation=enable',
531+
'gssencmode=prefer gssdelegation=1',
532532
'succeeds with GSS-encrypted access preferred and hostgssenc hba and credentials forwarded',
533533
"connection authenticated: identity=\"test1\@$realm\" method=gss",
534534
"connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, delegated_credentials=yes, principal=test1\@$realm)"
@@ -538,7 +538,7 @@ sub test_query
538538
'test1',
539539
'SELECT gss_authenticated AND encrypted AND credentials_delegated from pg_stat_gssapi where pid = pg_backend_pid();',
540540
0,
541-
'gssencmode=require gssdelegation=enable',
541+
'gssencmode=require gssdelegation=1',
542542
'succeeds with GSS-encrypted access required and hostgssenc hba and credentials forwarded',
543543
"connection authenticated: identity=\"test1\@$realm\" method=gss",
544544
"connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, delegated_credentials=yes, principal=test1\@$realm)"
@@ -558,7 +558,7 @@ sub test_query
558558
'test1',
559559
'SELECT gss_authenticated AND encrypted AND NOT credentials_delegated FROM pg_stat_gssapi WHERE pid = pg_backend_pid();',
560560
0,
561-
'gssencmode=require gssdelegation=disable',
561+
'gssencmode=require gssdelegation=0',
562562
'succeeds with GSS-encrypted access required and hostgssenc hba and credentials explicitly not forwarded',
563563
"connection authenticated: identity=\"test1\@$realm\" method=gss",
564564
"connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, delegated_credentials=no, principal=test1\@$realm)"
@@ -572,7 +572,7 @@ sub test_query
572572
'postgres',
573573
"SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port','select 1') as t1(c1 int);",
574574
connstr =>
575-
"user=test1 host=$host hostaddr=$hostaddr gssencmode=require gssdelegation=disable",
575+
"user=test1 host=$host hostaddr=$hostaddr gssencmode=require gssdelegation=0",
576576
stdout => \$psql_out,
577577
stderr => \$psql_stderr);
578578
is($psql_rc, '3', 'dblink attempt fails without delegated credentials');
@@ -589,7 +589,7 @@ sub test_query
589589
'postgres',
590590
"SELECT * FROM dblink('user=test2 dbname=$dbname port=$port passfile=$pgpass','select 1') as t1(c1 int);",
591591
connstr =>
592-
"user=test1 host=$host hostaddr=$hostaddr gssencmode=require gssdelegation=disable",
592+
"user=test1 host=$host hostaddr=$hostaddr gssencmode=require gssdelegation=0",
593593
stdout => \$psql_out,
594594
stderr => \$psql_stderr);
595595
is($psql_rc, '3',
@@ -608,7 +608,7 @@ sub test_query
608608
'postgres',
609609
"TABLE tf1;",
610610
connstr =>
611-
"user=test1 host=$host hostaddr=$hostaddr gssencmode=require gssdelegation=disable",
611+
"user=test1 host=$host hostaddr=$hostaddr gssencmode=require gssdelegation=0",
612612
stdout => \$psql_out,
613613
stderr => \$psql_stderr);
614614
is($psql_rc, '3', 'postgres_fdw does not work without delegated credentials');
@@ -626,7 +626,7 @@ sub test_query
626626
'postgres',
627627
"TABLE tf2;",
628628
connstr =>
629-
"user=test1 host=$host hostaddr=$hostaddr gssencmode=require gssdelegation=disable",
629+
"user=test1 host=$host hostaddr=$hostaddr gssencmode=require gssdelegation=0",
630630
stdout => \$psql_out,
631631
stderr => \$psql_stderr);
632632
is($psql_rc, '3',
@@ -668,7 +668,7 @@ sub test_query
668668
'test1',
669669
'SELECT gss_authenticated AND NOT encrypted AND credentials_delegated FROM pg_stat_gssapi WHERE pid = pg_backend_pid();',
670670
0,
671-
'gssencmode=prefer gssdelegation=enable',
671+
'gssencmode=prefer gssdelegation=1',
672672
'succeeds with GSS-encrypted access preferred and hostnogssenc hba, but no encryption',
673673
"connection authenticated: identity=\"test1\@$realm\" method=gss",
674674
"connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, delegated_credentials=yes, principal=test1\@$realm)"
@@ -680,7 +680,7 @@ sub test_query
680680
'test1',
681681
'SELECT gss_authenticated AND NOT encrypted AND credentials_delegated FROM pg_stat_gssapi WHERE pid = pg_backend_pid();',
682682
0,
683-
'gssencmode=disable gssdelegation=enable',
683+
'gssencmode=disable gssdelegation=1',
684684
'succeeds with GSS encryption disabled and hostnogssenc hba',
685685
"connection authenticated: identity=\"test1\@$realm\" method=gss",
686686
"connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=no, delegated_credentials=yes, principal=test1\@$realm)"
@@ -691,7 +691,7 @@ sub test_query
691691
'test1',
692692
"SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port','select 1') as t1(c1 int);",
693693
qr/^1$/s,
694-
'gssencmode=prefer gssdelegation=enable',
694+
'gssencmode=prefer gssdelegation=1',
695695
'dblink works not-encrypted (server not configured to accept encrypted GSSAPI connections)'
696696
);
697697

@@ -700,7 +700,7 @@ sub test_query
700700
'test1',
701701
"TABLE tf1;",
702702
qr/^1$/s,
703-
'gssencmode=prefer gssdelegation=enable',
703+
'gssencmode=prefer gssdelegation=1',
704704
'postgres_fdw works not-encrypted (server not configured to accept encrypted GSSAPI connections)'
705705
);
706706

@@ -711,7 +711,7 @@ sub test_query
711711
'postgres',
712712
"SELECT * FROM dblink('user=test2 dbname=$dbname port=$port passfile=$pgpass','select 1') as t1(c1 int);",
713713
connstr =>
714-
"user=test1 host=$host hostaddr=$hostaddr gssencmode=prefer gssdelegation=enable",
714+
"user=test1 host=$host hostaddr=$hostaddr gssencmode=prefer gssdelegation=1",
715715
stdout => \$psql_out,
716716
stderr => \$psql_stderr);
717717
is($psql_rc, '3',
@@ -730,7 +730,7 @@ sub test_query
730730
'postgres',
731731
"TABLE tf2;",
732732
connstr =>
733-
"user=test1 host=$host hostaddr=$hostaddr gssencmode=prefer gssdelegation=enable",
733+
"user=test1 host=$host hostaddr=$hostaddr gssencmode=prefer gssdelegation=1",
734734
stdout => \$psql_out,
735735
stderr => \$psql_stderr);
736736
is($psql_rc, '3',
@@ -760,7 +760,7 @@ sub test_query
760760
'test1',
761761
'SELECT gss_authenticated AND encrypted AND credentials_delegated FROM pg_stat_gssapi WHERE pid = pg_backend_pid();',
762762
0,
763-
'gssdelegation=enable',
763+
'gssdelegation=1',
764764
'succeeds with include_realm=0 and defaults',
765765
"connection authenticated: identity=\"test1\@$realm\" method=gss",
766766
"connection authorized: user=$username database=$dbname application_name=$application GSS (authenticated=yes, encrypted=yes, delegated_credentials=yes, principal=test1\@$realm)"
@@ -771,12 +771,12 @@ sub test_query
771771
'test1',
772772
"SELECT * FROM dblink('user=test1 dbname=$dbname host=$host hostaddr=$hostaddr port=$port password=1234','select 1') as t1(c1 int);",
773773
qr/^1$/s,
774-
'gssencmode=require gssdelegation=enable',
774+
'gssencmode=require gssdelegation=1',
775775
'dblink works encrypted');
776776

777777
test_query(
778778
$node, 'test1', "TABLE tf1;", qr/^1$/s,
779-
'gssencmode=require gssdelegation=enable',
779+
'gssencmode=require gssdelegation=1',
780780
'postgres_fdw works encrypted');
781781

782782
# Reset pg_hba.conf, and cause a usermap failure with an authentication

‎src/test/perl/PostgreSQL/Test/Utils.pm

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,7 @@ BEGIN
113113
PGCONNECT_TIMEOUT
114114
PGDATA
115115
PGDATABASE
116+
PGGSSDELEGATION
116117
PGGSSENCMODE
117118
PGGSSLIB
118119
PGHOSTADDR

‎src/test/regress/pg_regress.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -798,6 +798,7 @@ initialize_environment(void)
798798
unsetenv("PGCONNECT_TIMEOUT");
799799
unsetenv("PGDATA");
800800
unsetenv("PGDATABASE");
801+
unsetenv("PGGSSDELEGATION");
801802
unsetenv("PGGSSENCMODE");
802803
unsetenv("PGGSSLIB");
803804
/* PGHOSTADDR, see below */

0 commit comments

Comments
 (0)