Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit1b4e729

Browse files
committed
Make krb_realm and krb_server_hostname be pg_hba options only, and remove
their GUCs.In passing, noted that the pg_hba options for krb5 authentication weren'tlisted at all - so add this.
1 parent32e1265 commit1b4e729

File tree

5 files changed

+72
-112
lines changed

5 files changed

+72
-112
lines changed

‎doc/src/sgml/client-auth.sgml

Lines changed: 55 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.117 2009/01/0713:09:21 mha Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.118 2009/01/09 10:13:18 mha Exp $ -->
22

33
<chapter id="client-authentication">
44
<title>Client Authentication</title>
@@ -801,18 +801,8 @@ omicron bryanh guest1
801801
<term>krb_realm</term>
802802
<listitem>
803803
<para>
804-
Overrides the <xref linkend="guc-krb-realm"> parameter, setting which realm
805-
to verify the authenticated user principal against.
806-
</para>
807-
</listitem>
808-
</varlistentry>
809-
810-
<varlistentry>
811-
<term>krb_server_hostname</term>
812-
<listitem>
813-
<para>
814-
Overrides the <xref linkend="guc-krb-server-hostname"> parameter, setting which
815-
hostname will be used for the server principal when using Kerberos.
804+
Sets the realm to match user principal names against. If this parameter
805+
is not set, the realm of the user will be ignored.
816806
</para>
817807
</listitem>
818808
</varlistentry>
@@ -874,8 +864,8 @@ omicron bryanh guest1
874864
<term>krb_realm</term>
875865
<listitem>
876866
<para>
877-
Overrides the<xref linkend="guc-krb-realm"> parameter, setting which realm
878-
to verifytheauthenticateduserprincipal against.
867+
Sets the realm to match user principal names against. If this parameter
868+
is not set,therealm of theuserwill be ignored.
879869
</para>
880870
</listitem>
881871
</varlistentry>
@@ -953,7 +943,7 @@ omicron bryanh guest1
953943
<literal>pgusername@realm</>. By default, the realm of the client is
954944
not checked by <productname>PostgreSQL</>. If you have cross-realm
955945
authentication enabled and need to verify the realm, use the
956-
<xref linkend="guc-krb-realm">parameter.
946+
krb_realmparameter in <filename>pg_hba.conf</>.
957947
</para>
958948

959949
<para>
@@ -996,6 +986,55 @@ omicron bryanh guest1
996986
database access over the web, no extra passwords required.
997987
</para>
998988

989+
<para>
990+
The following configuration options are supported for <productname>Kerberos</productname>:
991+
<variablelist>
992+
<varlistentry>
993+
<term>map</term>
994+
<listitem>
995+
<para>
996+
Allows for mapping between system and database usernames. See
997+
<xref linkend="auth-username-maps"> for details.
998+
</para>
999+
</listitem>
1000+
</varlistentry>
1001+
1002+
<varlistentry>
1003+
<term>include_realm</term>
1004+
<listitem>
1005+
<para>
1006+
Include the realm name from the authenticated user principal. This is useful
1007+
in combination with Username maps (See <xref linkend="auth-username-maps">
1008+
for details), especially with regular expressions, to map users from
1009+
multiple realms.
1010+
</para>
1011+
</listitem>
1012+
</varlistentry>
1013+
1014+
<varlistentry>
1015+
<term>krb_realm</term>
1016+
<listitem>
1017+
<para>
1018+
Sets the realm to match user principal names against. If this parameter
1019+
is not set, the realm of the user will be ignored.
1020+
</para>
1021+
</listitem>
1022+
</varlistentry>
1023+
1024+
<varlistentry>
1025+
<term>krb_server_hostname</term>
1026+
<listitem>
1027+
<para>
1028+
Sets the host name part of the service principal.
1029+
This, combined with <varname>krb_srvname</>, is used to generate
1030+
the complete service principal, that is
1031+
<varname>krb_srvname</><literal>/</><varname>krb_server_hostname</><literal>@</>REALM.
1032+
If not set, the default is the server host name.
1033+
</para>
1034+
</listitem>
1035+
</varlistentry>
1036+
</variablelist>
1037+
</para>
9991038
</sect2>
10001039

10011040
<sect2 id="auth-ident">

‎doc/src/sgml/config.sgml

Lines changed: 1 addition & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/config.sgml,v 1.203 2009/01/07 22:40:48 tgl Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/config.sgml,v 1.204 2009/01/09 10:13:18 mha Exp $ -->
22

33
<chapter Id="runtime-config">
44
<title>Server Configuration</title>
@@ -612,22 +612,6 @@ SET ENABLE_SEQSCAN TO OFF;
612612
</listitem>
613613
</varlistentry>
614614

615-
<varlistentry id="guc-krb-realm" xreflabel="krb_realm">
616-
<term><varname>krb_realm</varname> (<type>string</type>)</term>
617-
<indexterm>
618-
<primary><varname>krb_realm</> configuration parameter</primary>
619-
</indexterm>
620-
<listitem>
621-
<para>
622-
Sets the realm to match Kerberos, GSSAPI and SSPI user names against.
623-
See <xref linkend="kerberos-auth">, <xref linkend="gssapi-auth"> or
624-
<xref linkend="sspi-auth"> for details. This parameter can only be
625-
set in the <filename>postgresql.conf</> file or on the server
626-
command line.
627-
</para>
628-
</listitem>
629-
</varlistentry>
630-
631615
<varlistentry id="guc-krb-server-keyfile" xreflabel="krb_server_keyfile">
632616
<term><varname>krb_server_keyfile</varname> (<type>string</type>)</term>
633617
<indexterm>
@@ -657,24 +641,6 @@ SET ENABLE_SEQSCAN TO OFF;
657641
</listitem>
658642
</varlistentry>
659643

660-
<varlistentry id="guc-krb-server-hostname" xreflabel="krb_server_hostname">
661-
<term><varname>krb_server_hostname</varname> (<type>string</type>)</term>
662-
<indexterm>
663-
<primary><varname>krb_server_hostname</> configuration parameter</primary>
664-
</indexterm>
665-
<listitem>
666-
<para>
667-
Sets the host name part of the service principal.
668-
This, combined with <varname>krb_srvname</>, is used to generate
669-
the complete service principal, that is
670-
<varname>krb_srvname</><literal>/</><varname>krb_server_hostname</><literal>@</>REALM.
671-
If not set, the default is the server host name. See <xref linkend="kerberos-auth">
672-
for details. This parameter can only be set in the <filename>postgresql.conf</>
673-
file or on the server command line.
674-
</para>
675-
</listitem>
676-
</varlistentry>
677-
678644
<varlistentry id="guc-krb-caseins-users" xreflabel="krb_caseins_users">
679645
<term><varname>krb_caseins_users</varname> (<type>boolean</type>)</term>
680646
<indexterm>

‎src/backend/libpq/auth.c

Lines changed: 15 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.177 2009/01/0713:09:21 mha Exp $
11+
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.178 2009/01/09 10:13:18 mha Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -129,8 +129,6 @@ static intCheckCertAuth(Port *port);
129129
char*pg_krb_server_keyfile;
130130
char*pg_krb_srvnam;
131131
boolpg_krb_caseins_users;
132-
char*pg_krb_server_hostname=NULL;
133-
char*pg_krb_realm=NULL;
134132

135133

136134
/*----------------------------------------------------------------
@@ -645,10 +643,7 @@ pg_krb5_init(Port *port)
645643
* If no hostname was specified, pg_krb_server_hostname is already NULL.
646644
* If it's set to blank, force it to NULL.
647645
*/
648-
if (port->hba->krb_server_hostname)
649-
khostname=port->hba->krb_server_hostname;
650-
else
651-
khostname=pg_krb_server_hostname;
646+
khostname=port->hba->krb_server_hostname;
652647
if (khostname&&khostname[0]=='\0')
653648
khostname=NULL;
654649

@@ -694,7 +689,6 @@ pg_krb5_recvauth(Port *port)
694689
krb5_ticket*ticket;
695690
char*kusername;
696691
char*cp;
697-
char*realmmatch;
698692

699693
if (get_role_line(port->user_name)==NULL)
700694
returnSTATUS_ERROR;
@@ -740,11 +734,6 @@ pg_krb5_recvauth(Port *port)
740734
returnSTATUS_ERROR;
741735
}
742736

743-
if (port->hba->krb_realm)
744-
realmmatch=port->hba->krb_realm;
745-
else
746-
realmmatch=pg_krb_realm;
747-
748737
cp=strchr(kusername,'@');
749738
if (cp)
750739
{
@@ -757,27 +746,27 @@ pg_krb5_recvauth(Port *port)
757746
*cp='\0';
758747
cp++;
759748

760-
if (realmmatch!=NULL&&strlen(realmmatch))
749+
if (port->hba->krb_realm!=NULL&&strlen(port->hba->krb_realm))
761750
{
762751
/* Match realm against configured */
763752
if (pg_krb_caseins_users)
764-
ret=pg_strcasecmp(realmmatch,cp);
753+
ret=pg_strcasecmp(port->hba->krb_realm,cp);
765754
else
766-
ret=strcmp(realmmatch,cp);
755+
ret=strcmp(port->hba->krb_realm,cp);
767756

768757
if (ret)
769758
{
770759
elog(DEBUG2,
771760
"krb5 realm (%s) and configured realm (%s) don't match",
772-
cp,realmmatch);
761+
cp,port->hba->krb_realm);
773762

774763
krb5_free_ticket(pg_krb5_context,ticket);
775764
krb5_auth_con_free(pg_krb5_context,auth_context);
776765
returnSTATUS_ERROR;
777766
}
778767
}
779768
}
780-
elseif (realmmatch&&strlen(realmmatch))
769+
elseif (port->hba->krb_realm&&strlen(port->hba->krb_realm))
781770
{
782771
elog(DEBUG2,
783772
"krb5 did not return realm but realm matching was requested");
@@ -874,7 +863,6 @@ pg_GSS_recvauth(Port *port)
874863
intret;
875864
StringInfoDatabuf;
876865
gss_buffer_descgbuf;
877-
char*realmmatch;
878866

879867
/*
880868
* GSS auth is not supported for protocol versions before 3, because it
@@ -1034,11 +1022,6 @@ pg_GSS_recvauth(Port *port)
10341022
gettext_noop("retrieving GSS user name failed"),
10351023
maj_stat,min_stat);
10361024

1037-
if (port->hba->krb_realm)
1038-
realmmatch=port->hba->krb_realm;
1039-
else
1040-
realmmatch=pg_krb_realm;
1041-
10421025
/*
10431026
* Split the username at the realm separator
10441027
*/
@@ -1055,28 +1038,28 @@ pg_GSS_recvauth(Port *port)
10551038
*cp='\0';
10561039
cp++;
10571040

1058-
if (realmmatch!=NULL&&strlen(realmmatch))
1041+
if (port->hba->krb_realm!=NULL&&strlen(port->hba->krb_realm))
10591042
{
10601043
/*
10611044
* Match the realm part of the name first
10621045
*/
10631046
if (pg_krb_caseins_users)
1064-
ret=pg_strcasecmp(realmmatch,cp);
1047+
ret=pg_strcasecmp(port->hba->krb_realm,cp);
10651048
else
1066-
ret=strcmp(realmmatch,cp);
1049+
ret=strcmp(port->hba->krb_realm,cp);
10671050

10681051
if (ret)
10691052
{
10701053
/* GSS realm does not match */
10711054
elog(DEBUG2,
10721055
"GSSAPI realm (%s) and configured realm (%s) don't match",
1073-
cp,realmmatch);
1056+
cp,port->hba->krb_realm);
10741057
gss_release_buffer(&lmin_s,&gbuf);
10751058
returnSTATUS_ERROR;
10761059
}
10771060
}
10781061
}
1079-
elseif (realmmatch&&strlen(realmmatch))
1062+
elseif (port->hba->krb_realm&&strlen(port->hba->krb_realm))
10801063
{
10811064
elog(DEBUG2,
10821065
"GSSAPI did not return realm but realm matching was requested");
@@ -1140,7 +1123,6 @@ pg_SSPI_recvauth(Port *port)
11401123
SID_NAME_USEaccountnameuse;
11411124
HMODULEsecur32;
11421125
QUERY_SECURITY_CONTEXT_TOKEN_FN_QuerySecurityContextToken;
1143-
char*realmmatch;
11441126

11451127
/*
11461128
* SSPI auth is not supported for protocol versions before 3, because it
@@ -1353,18 +1335,13 @@ pg_SSPI_recvauth(Port *port)
13531335
* Compare realm/domain if requested. In SSPI, always compare case
13541336
* insensitive.
13551337
*/
1356-
if (port->hba->krb_realm)
1357-
realmmatch=port->hba->krb_realm;
1358-
else
1359-
realmmatch=pg_krb_realm;
1360-
1361-
if (realmmatch&&strlen(realmmatch))
1338+
if (port->hba->krb_realm&&strlen(port->hba->krb_realm))
13621339
{
1363-
if (pg_strcasecmp(realmmatch,domainname))
1340+
if (pg_strcasecmp(port->hba->krb_realm,domainname))
13641341
{
13651342
elog(DEBUG2,
13661343
"SSPI domain (%s) and configured domain (%s) don't match",
1367-
domainname,realmmatch);
1344+
domainname,port->hba->krb_realm);
13681345

13691346
returnSTATUS_ERROR;
13701347
}

‎src/backend/utils/misc/guc.c

Lines changed: 1 addition & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
* Written by Peter Eisentraut <peter_e@gmx.net>.
1111
*
1212
* IDENTIFICATION
13-
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.491 2009/01/07 22:40:49 tgl Exp $
13+
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.492 2009/01/09 10:13:18 mha Exp $
1414
*
1515
*--------------------------------------------------------------------
1616
*/
@@ -2130,16 +2130,6 @@ static struct config_string ConfigureNamesString[] =
21302130
"$libdir",NULL,NULL
21312131
},
21322132

2133-
{
2134-
{"krb_realm",PGC_SIGHUP,CONN_AUTH_SECURITY,
2135-
gettext_noop("Sets realm to match Kerberos and GSSAPI users against."),
2136-
NULL,
2137-
GUC_SUPERUSER_ONLY
2138-
},
2139-
&pg_krb_realm,
2140-
NULL,NULL,NULL
2141-
},
2142-
21432133
{
21442134
{"krb_server_keyfile",PGC_SIGHUP,CONN_AUTH_SECURITY,
21452135
gettext_noop("Sets the location of the Kerberos server key file."),
@@ -2159,15 +2149,6 @@ static struct config_string ConfigureNamesString[] =
21592149
PG_KRB_SRVNAM,NULL,NULL
21602150
},
21612151

2162-
{
2163-
{"krb_server_hostname",PGC_SIGHUP,CONN_AUTH_SECURITY,
2164-
gettext_noop("Sets the hostname of the Kerberos server."),
2165-
NULL
2166-
},
2167-
&pg_krb_server_hostname,
2168-
NULL,NULL,NULL
2169-
},
2170-
21712152
{
21722153
{"bonjour_name",PGC_POSTMASTER,CONN_AUTH_SETTINGS,
21732154
gettext_noop("Sets the Bonjour broadcast service name."),

‎src/backend/utils/misc/postgresql.conf.sample

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -81,10 +81,7 @@
8181
# Kerberos and GSSAPI
8282
#krb_server_keyfile = ''
8383
#krb_srvname = 'postgres'# (Kerberos only)
84-
#krb_server_hostname = ''# empty string matches any keytab entry
85-
# (Kerberos only)
8684
#krb_caseins_users = off
87-
#krb_realm = ''
8885

8986
# - TCP Keepalives -
9087
# see "man 7 tcp" for details

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp