Skip to content

Commit f70866f

Browse files
mhagandermhagander
committed
SSPI authentication on Windows. GSSAPI compatible client when doing Kerberos
against a Unix server, and Windows-specific server-side authentication using SSPI "negotiate" method (Kerberos or NTLM). Only builds properly with MSVC for now.
1 parent a0dab33 commit f70866f

File tree

15 files changed

+708
-78
lines changed

15 files changed

+708
-78
lines changed

‎doc/src/sgml/client-auth.sgml

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.99 2007/07/18 12:00:47 mha Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.100 2007/07/23 10:16:53 mha Exp $ -->
22

33
<chapter id="client-authentication">
44
<title>Client Authentication</title>
@@ -358,6 +358,17 @@ hostnossl <replaceable>database</replaceable> <replaceable>user</replaceable>
358358
</listitem>
359359
</varlistentry>
360360

361+
<varlistentry>
362+
<term><literal>sspi</></term>
363+
<listitem>
364+
<para>
365+
Use SSPI to authenticate the user. This is only
366+
available on Windows. See <xref
367+
linkend="sspi-auth"> for details.
368+
</para>
369+
</listitem>
370+
</varlistentry>
371+
361372
<varlistentry>
362373
<term><literal>krb5</></term>
363374
<listitem>
@@ -677,6 +688,33 @@ local db1,db2,@demodbs all md5
677688

678689
</sect2>
679690

691+
<sect2 id="sspi-auth">
692+
<title>SSPI authentication</title>
693+
694+
<indexterm zone="sspi-auth">
695+
<primary>SSPI</primary>
696+
</indexterm>
697+
698+
<para>
699+
<productname>SSPI</productname> is a <productname>Windows</productname>
700+
technology for secure authentication with single sign-on.
701+
<productname>PostgreSQL</productname> will use SSPI in
702+
<literal>negotiate</literal> mode, which will use
703+
<productname>Kerberos</productname> when possible and automatically
704+
fall back to <productname>NTLM</productname> in other cases.
705+
<productname>SSPI</productname> authentication only works when both
706+
server and client are running <productname>Windows</productname>.
707+
</para>
708+
709+
<para>
710+
When using <productname>Kerberos</productname> authentication,
711+
<productname>SSPI</productname> works the same way
712+
<productname>GSSAPI</productname> does. See <xref linkend="gssapi-auth">
713+
for details.
714+
</para>
715+
716+
</sect2>
717+
680718
<sect2 id="kerberos-auth">
681719
<title>Kerberos authentication</title>
682720

‎doc/src/sgml/libpq.sgml

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.238 2007/07/18 12:00:47 mha Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.239 2007/07/23 10:16:53 mha Exp $ -->
22

33
<chapter id="libpq">
44
<title><application>libpq</application> - C Library</title>
@@ -290,6 +290,17 @@ PGconn *PQconnectdb(const char *conninfo);
290290
</listitem>
291291
</varlistentry>
292292

293+
<varlistentry>
294+
<term><literal>gsslib</literal></term>
295+
<listitem>
296+
<para>
297+
GSS library to use for GSSAPI authentication. Only used on Windows.
298+
Set to <literal>gssapi</literal> to force libpq to use the GSSAPI
299+
library for authentication instead of the default SSPI.
300+
</para>
301+
</listitem>
302+
</varlistentry>
303+
293304
<varlistentry>
294305
<term><literal>service</literal></term>
295306
<listitem>
@@ -4220,6 +4231,15 @@ authenticating with Kerberos 5 or GSSAPI.
42204231
</listitem>
42214232
<listitem>
42224233
<para>
4234+
<indexterm>
4235+
<primary><envar>PGGSSLIB</envar></primary>
4236+
</indexterm>
4237+
<envar>PGGSSLIB</envar> sets the GSS library to use for GSSAPI
4238+
authentication.
4239+
</para>
4240+
</listitem>
4241+
<listitem>
4242+
<para>
42234243
<indexterm>
42244244
<primary><envar>PGCONNECT_TIMEOUT</envar></primary>
42254245
</indexterm>

0 commit comments

Comments
 (0)