Skip to content

Commit 72c53ac

Browse files
bmomjianbmomjian
committed
Allow kerberos name and username case sensitivity to be specified from postgresql.conf. --------------------------------------------------------------------------- Here's an updated version of the patch, with the following changes: 1) No longer uses "service name" as "application version". It's instead hardcoded as "postgres". It could be argued that this part should be backpatched to 8.0, but it doesn't make a big difference until you can start changing it with GUC / connection parameters. This change only affects kerberos 5, not 4. 2) Now downcases kerberos usernames when the client is running on win32. 3) Adds guc option for "krb_caseins_users" to make the server ignore case mismatch which is required by some KDCs such as Active Directory. Off by default, per discussion with Tom. This change only affects kerberos 5, not 4. 4) Updated so it doesn't conflict with the rendevouz/bonjour patch already in ;-) Magnus Hagander
1 parent d995014 commit 72c53ac

File tree

14 files changed

+167
-52
lines changed

14 files changed

+167
-52
lines changed

‎configure

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -869,7 +869,7 @@ Optional Packages:
869869
--with-python build Python modules (PL/Python)
870870
--with-krb4 build with Kerberos 4 support
871871
--with-krb5 build with Kerberos 5 support
872-
--with-krb-srvnam=NAME name of the service principal in Kerberos [postgres]
872+
--with-krb-srvnam=NAME name of the default service principal in Kerberos [postgres]
873873
--with-pam build with PAM support
874874
--with-bonjour build with Bonjour support
875875
--with-openssl build with OpenSSL support

‎configure.in

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
dnl Process this file with autoconf to produce a configure script.
2-
dnl $PostgreSQL: pgsql/configure.in,v 1.411 2005/05/15 00:26:18 momjian Exp $
2+
dnl $PostgreSQL: pgsql/configure.in,v 1.412 2005/06/04 20:42:41 momjian Exp $
33
dnl
44
dnl Developers, please strive to achieve this order:
55
dnl
@@ -447,11 +447,11 @@ AC_SUBST(krb_srvtab)
447447
# Kerberos configuration parameters
448448
#
449449
PGAC_ARG_REQ(with, krb-srvnam,
450-
[ --with-krb-srvnam=NAME name of the service principal in Kerberos [[postgres]]],
450+
[ --with-krb-srvnam=NAME name of the default service principal in Kerberos [[postgres]]],
451451
[],
452452
[with_krb_srvnam="postgres"])
453453
AC_DEFINE_UNQUOTED([PG_KRB_SRVNAM], ["$with_krb_srvnam"],
454-
[Define to the name of the PostgreSQL service principal in Kerberos. (--with-krb-srvnam=NAME)])
454+
[Define to the name of the default PostgreSQL service principal in Kerberos. (--with-krb-srvnam=NAME)])
455455

456456

457457
#

‎doc/src/sgml/client-auth.sgml

Lines changed: 25 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.79 2005/04/27 20:11:07 momjian Exp $
2+
$PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.80 2005/06/04 20:42:41 momjian Exp $
33
-->
44

55
<chapter id="client-authentication">
@@ -617,7 +617,7 @@ local db1,db2,@demodbs all md5
617617
quite complex (yet powerful). The
618618
<ulink url="http://www.nrl.navy.mil/CCS/people/kenh/kerberos-faq.html">
619619
Kerberos <acronym>FAQ</></ulink> or
620-
<ulink url="ftp://athena-dist.mit.edu">MIT Project Athena</ulink>
620+
<ulink url="http://web.mit.edu/kerberos/www/">MIT Kerberos page</ulink>
621621
can be a good starting point for exploration.
622622
Several sources for <productname>Kerberos</> distributions exist.
623623
</para>
@@ -626,23 +626,29 @@ local db1,db2,@demodbs all md5
626626
While <productname>PostgreSQL</> supports both Kerberos 4 and
627627
Kerberos 5, only Kerberos 5 is recommended. Kerberos 4 is
628628
considered insecure and no longer recommended for general
629-
use.
630-
</para>
631-
632-
<para>
633-
In order to use <productname>Kerberos</>, support for it must be
634-
enabled at build time. See <xref linkend="installation"> for more
635-
information. Both Kerberos 4 and 5 are supported, but only one
636-
version can be supported in any one build.
629+
use. Only one version of Kerberos can be supported in any one
630+
build, and support must be enabled at build time. See
631+
<xref linkend="installation"> for more information.
637632
</para>
638633

639634
<para>
640635
<productname>PostgreSQL</> operates like a normal Kerberos service.
641636
The name of the service principal is
642-
<literal><replaceable>servicename</>/<replaceable>hostname</>@<replaceable>realm</></literal>, where
643-
<replaceable>servicename</> is <literal>postgres</literal> (unless a
644-
different service name was selected at configure time with
645-
<literal>./configure --with-krb-srvnam=whatever</>).
637+
<literal><replaceable>servicename</>/<replaceable>hostname</>@<replaceable>realm</></literal>.
638+
</para>
639+
<para>
640+
<replaceable>servicename</> can be set on the server side using the
641+
<xref linkend="guc-krb-srvname"> configuration parameter, and on the
642+
client side using the krbsrvname connection parameter. (See also <xref linkend="libpq-connect">.). The installation default can be changed from the default
643+
<literal>postgres</literal> at build time using
644+
<literal>./configure --with-krb-srvnam=whatever</>). In most environments,
645+
this parameter never needs to be changed. However, to support multiple
646+
<productname>PostgreSQL</> installations on the same host it is necessary.
647+
Some Kerberos implementations may also require a different service name,
648+
such as Microsoft Active Directory which requires the service name
649+
to be in uppercase (<literal>POSTGRES</literal>).
650+
</para>
651+
<para>
646652
<replaceable>hostname</> is the fully qualified host name of the
647653
server machine. The service principal's realm is the preferred realm
648654
of the server machine.
@@ -658,25 +664,26 @@ local db1,db2,@demodbs all md5
658664
</para>
659665

660666
<para>
661-
Make sure that your server key file is readable (and preferably
667+
Make sure that your server keytab file is readable (and preferably
662668
only readable) by the <productname>PostgreSQL</productname> server
663669
account. (See also <xref linkend="postgres-user">.) The location
664670
of the key file is specified by the <xref
665671
linkend="guc-krb-server-keyfile"> configuration
666-
parameter. (See also <xref linkend="runtime-config">.) The default
672+
parameter. The default
667673
is <filename>/etc/srvtab</> if you are using Kerberos 4 and
668674
<filename>/usr/local/pgsql/etc/krb5.keytab</> (or whichever
669675
directory was specified as <varname>sysconfdir</> at build time)
670676
with Kerberos 5.
671677
</para>
672678

673679
<para>
674-
To generate the keytab file, use for example (with version 5)
680+
The keytab file is generated in the Kerberos system, see the
681+
Kerberos documentation for details. The following example is
682+
for MIT-compatible Kerberos 5 implementations:
675683
<screen>
676684
<prompt>kadmin% </><userinput>ank -randkey postgres/server.my.domain.org</>
677685
<prompt>kadmin% </><userinput>ktadd -k krb5.keytab postgres/server.my.domain.org</>
678686
</screen>
679-
Read the <productname>Kerberos</> documentation for details.
680687
</para>
681688

682689
<para>

‎doc/src/sgml/installation.sgml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/installation.sgml,v 1.233 2005/05/15 00:26:18 momjian Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/installation.sgml,v 1.234 2005/06/04 20:42:41 momjian Exp $ -->
22

33
<chapter id="installation">
44
<title><![%standalone-include[<productname>PostgreSQL</>]]>
@@ -816,8 +816,8 @@ su - postgres
816816
<term><option>--with-krb-srvnam=<replaceable>NAME</></option></term>
817817
<listitem>
818818
<para>
819-
The name of the Kerberos service principal.
820-
<literal>postgres</literal> is the default. There's probably no
819+
The default name of the Kerberos service principal.
820+
<literal>postgres</literal> is the default. There's usually no
821821
reason to change this.
822822
</para>
823823
</listitem>

‎doc/src/sgml/libpq.sgml

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.181 2005/05/30 19:32:44 momjian Exp $
2+
$PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.182 2005/06/04 20:42:41 momjian Exp $
33
-->
44

55
<chapter id="libpq">
@@ -279,6 +279,18 @@ PGconn *PQconnectdb(const char *conninfo);
279279
</listitem>
280280
</varlistentry>
281281

282+
<varlistentry>
283+
<term><literal>krbsrvname</literal></term>
284+
<listitem>
285+
<para>
286+
Kerberos service name to use when authenticating with Kerberos 4 or 5.
287+
This must match the service name specified in the server
288+
configuration for Kerberos authentication to succeed. (See also
289+
<xref linkend="kerberos-auth">.)
290+
</para>
291+
</listitem>
292+
</varlistentry>
293+
282294
<varlistentry>
283295
<term><literal>service</literal></term>
284296
<listitem>
@@ -3770,6 +3782,15 @@ setting, and is only available if
37703782
</listitem>
37713783
<listitem>
37723784
<para>
3785+
<indexterm>
3786+
<primary><envar>PGKRBSRVNAME</envar></primary>
3787+
</indexterm>
3788+
<envar>PGKRBSRVNAME</envar> sets the Kerberos service name to use when
3789+
authenticating with Kerberos 4 or 5.
3790+
</para>
3791+
</listitem>
3792+
<listitem>
3793+
<para>
37733794
<indexterm>
37743795
<primary><envar>PGCONNECT_TIMEOUT</envar></primary>
37753796
</indexterm>

‎doc/src/sgml/runtime.sgml

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.321 2005/05/25 02:56:15 neilc Exp $
2+
$PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.322 2005/06/04 20:42:41 momjian Exp $
33
-->
44

55
<chapter Id="runtime">
@@ -955,11 +955,39 @@ SET ENABLE_SEQSCAN TO OFF;
955955
<listitem>
956956
<para>
957957
Sets the location of the Kerberos server key file. See
958-
<xref linkend="kerberos-auth"> for details.
958+
<xref linkend="kerberos-auth"> for details. This parameter
959+
can only be set at server start.
959960
</para>
960961
</listitem>
961962
</varlistentry>
962963

964+
<varlistentry id="guc-krb-srvname" xreflabel="krb_srvname">
965+
<term><varname>krb_srvname</varname> (<type>string</type>)</term>
966+
<indexterm>
967+
<primary><varname>krb_srvname</> configuration parameter</primary>
968+
</indexterm>
969+
<listitem>
970+
<para>
971+
Sets the Kerberos service name. See <xref linkend="kerberos-auth">
972+
for details. This parameter can only be set at server start.
973+
</para>
974+
</listitem>
975+
</varlistentry>
976+
977+
<varlistentry id="guc-krb-caseins-users" xreflabel="krb_caseins_users">
978+
<term><varname>krb_caseins_users</varname> (<type>boolean</type>)</term>
979+
<indexterm>
980+
<primary><varname>krb_caseins_users</varname> configuration parameter</primary>
981+
</indexterm>
982+
<listitem>
983+
<para>
984+
Sets if Kerberos usernames should be treated case-insensitive.
985+
The default is off (case sensitive). This parameter can only be
986+
set at server start.
987+
</para>
988+
</listitem>
989+
</varlistentry>
990+
963991
<varlistentry id="guc-db-user-namespace" xreflabel="db_user_namespace">
964992
<term><varname>db_user_namespace</varname> (<type>boolean</type>)</term>
965993
<indexterm>

‎src/backend/libpq/auth.c

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.123 2005/02/22 04:35:57 momjian Exp $
11+
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.124 2005/06/04 20:42:42 momjian Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -41,6 +41,8 @@ static char *recv_password_packet(Port *port);
4141
static int recv_and_check_password_packet(Port *port);
4242

4343
char *pg_krb_server_keyfile;
44+
char *pg_krb_srvnam;
45+
bool pg_krb_caseins_users;
4446

4547
#ifdef USE_PAM
4648
#ifdef HAVE_PAM_PAM_APPL_H
@@ -99,7 +101,7 @@ pg_krb4_recvauth(Port *port)
99101
status = krb_recvauth(krbopts,
100102
port->sock,
101103
&clttkt,
102-
PG_KRB_SRVNAM,
104+
pg_krb_srvnam,
103105
instance,
104106
&port->raddr.in,
105107
&port->laddr.in,
@@ -219,16 +221,16 @@ pg_krb5_init(void)
219221
return STATUS_ERROR;
220222
}
221223

222-
retval = krb5_sname_to_principal(pg_krb5_context, NULL, PG_KRB_SRVNAM,
224+
retval = krb5_sname_to_principal(pg_krb5_context, NULL, pg_krb_srvnam,
223225
KRB5_NT_SRV_HST, &pg_krb5_server);
224226
if (retval)
225227
{
226228
ereport(LOG,
227229
(errmsg("Kerberos sname_to_principal(\"%s\") returned error %d",
228-
PG_KRB_SRVNAM, retval)));
230+
pg_krb_srvnam, retval)));
229231
com_err("postgres", retval,
230232
"while getting server principal for service \"%s\"",
231-
PG_KRB_SRVNAM);
233+
pg_krb_srvnam);
232234
krb5_kt_close(pg_krb5_context, pg_krb5_keytab);
233235
krb5_free_context(pg_krb5_context);
234236
return STATUS_ERROR;
@@ -264,7 +266,7 @@ pg_krb5_recvauth(Port *port)
264266
return ret;
265267

266268
retval = krb5_recvauth(pg_krb5_context, &auth_context,
267-
(krb5_pointer) & port->sock, PG_KRB_SRVNAM,
269+
(krb5_pointer) & port->sock, "postgres",
268270
pg_krb5_server, 0, pg_krb5_keytab, &ticket);
269271
if (retval)
270272
{
@@ -303,7 +305,11 @@ pg_krb5_recvauth(Port *port)
303305
}
304306

305307
kusername = pg_an_to_ln(kusername);
306-
if (strncmp(port->user_name, kusername, SM_DATABASE_USER))
308+
if (pg_krb_caseins_users)
309+
ret = strncasecmp(port->user_name, kusername, SM_DATABASE_USER);
310+
else
311+
ret = strncmp(port->user_name, kusername, SM_DATABASE_USER);
312+
if (ret)
307313
{
308314
ereport(LOG,
309315
(errmsg("unexpected Kerberos user name received from client (received \"%s\", expected \"%s\")",

‎src/backend/utils/misc/guc.c

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
* Written by Peter Eisentraut <peter_e@gmx.net>.
1111
*
1212
* IDENTIFICATION
13-
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.263 2005/05/27 18:33:30 momjian Exp $
13+
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.264 2005/06/04 20:42:42 momjian Exp $
1414
*
1515
*--------------------------------------------------------------------
1616
*/
@@ -63,6 +63,9 @@
6363
#ifndef PG_KRB_SRVTAB
6464
#define PG_KRB_SRVTAB ""
6565
#endif
66+
#ifndef PG_KRB_SRVNAM
67+
#define PG_KRB_SRVNAM ""
68+
#endif
6669

6770
#define CONFIG_FILENAME "postgresql.conf"
6871
#define HBA_FILENAME "pg_hba.conf"
@@ -860,6 +863,15 @@ static struct config_bool ConfigureNamesBool[] =
860863
#endif
861864
},
862865

866+
{
867+
{"krb_caseins_users", PGC_POSTMASTER, CONN_AUTH_SECURITY,
868+
gettext_noop("Sets if Kerberos user names should be treated case insensitive."),
869+
NULL
870+
},
871+
&pg_krb_caseins_users,
872+
false, NULL, NULL
873+
},
874+
863875
/* End-of-list marker */
864876
{
865877
{NULL, 0, 0, NULL, NULL}, NULL, false, NULL, NULL
@@ -1572,6 +1584,15 @@ static struct config_string ConfigureNamesString[] =
15721584
PG_KRB_SRVTAB, NULL, NULL
15731585
},
15741586

1587+
{
1588+
{"krb_srvname", PGC_POSTMASTER, CONN_AUTH_SECURITY,
1589+
gettext_noop("Sets the name of the Kerberos service."),
1590+
NULL
1591+
},
1592+
&pg_krb_srvnam,
1593+
PG_KRB_SRVNAM, NULL, NULL
1594+
},
1595+
15751596
{
15761597
{"bonjour_name", PGC_POSTMASTER, CONN_AUTH_SETTINGS,
15771598
gettext_noop("Sets the Bonjour broadcast service name."),

‎src/backend/utils/misc/postgresql.conf.sample

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,8 +64,11 @@
6464
#authentication_timeout = 60 # 1-600, in seconds
6565
#ssl = false
6666
#password_encryption = true
67-
#krb_server_keyfile = ''
6867
#db_user_namespace = false
68+
# Kerberos
69+
#krb_server_keyfile = ''
70+
#krb_caseins_users = false
71+
#krb_srvname = 'postgres'
6972

7073

7174
#---------------------------------------------------------------------------

‎src/include/libpq/auth.h

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
* Portions Copyright (c) 1996-2005, PostgreSQL Global Development Group
88
* Portions Copyright (c) 1994, Regents of the University of California
99
*
10-
* $PostgreSQL: pgsql/src/include/libpq/auth.h,v 1.26 2004/12/31 22:03:32 pgsql Exp $
10+
* $PostgreSQL: pgsql/src/include/libpq/auth.h,v 1.27 2005/06/04 20:42:42 momjian Exp $
1111
*
1212
*-------------------------------------------------------------------------
1313
*/
@@ -27,5 +27,7 @@ extern void ClientAuthentication(Port *port);
2727
#define PG_KRB5_VERSION "PGVER5.1"
2828

2929
extern char *pg_krb_server_keyfile;
30+
extern char *pg_krb_srvnam;
31+
extern bool pg_krb_caseins_users;
3032

3133
#endif /* AUTH_H */

0 commit comments

Comments
 (0)