--with-python build Python modules (PL/Python)

--with-krb4 build with Kerberos 4 support

--with-krb5 build with Kerberos 5 support

--with-krb-srvnam=NAME name of the service principal in Kerberos [postgres]

--with-krb-srvnam=NAME name of thedefaultservice principal in Kerberos [postgres]

--with-pam build with PAM support

--with-bonjour build with Bonjour support

--with-openssl build with OpenSSL support

dnl Process this file with autoconf to produce a configure script.

dnl $PostgreSQL: pgsql/configure.in,v 1.411 2005/05/15 00:26:18 momjian Exp $

dnl $PostgreSQL: pgsql/configure.in,v 1.412 2005/06/04 20:42:41 momjian Exp $

dnl

dnl Developers, please strive to achieve this order:

dnl

# Kerberos configuration parameters

#

PGAC_ARG_REQ(with, krb-srvnam,

[ --with-krb-srvnam=NAME name of the service principal in Kerberos [[postgres]]],

[ --with-krb-srvnam=NAME name of thedefaultservice principal in Kerberos [[postgres]]],

[],

[with_krb_srvnam="postgres"])

AC_DEFINE_UNQUOTED([PG_KRB_SRVNAM], ["$with_krb_srvnam"],

[Define to the name of the PostgreSQL service principal in Kerberos. (--with-krb-srvnam=NAME)])

[Define to the name of thedefaultPostgreSQL service principal in Kerberos. (--with-krb-srvnam=NAME)])

#

<!--

$PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.79 2005/04/27 20:11:07 momjian Exp $

$PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.80 2005/06/04 20:42:41 momjian Exp $

-->

<chapter id="client-authentication">

quite complex (yet powerful). The

<ulink url="http://www.nrl.navy.mil/CCS/people/kenh/kerberos-faq.html">

Kerberos <acronym>FAQ</></ulink> or

<ulink url="ftp://athena-dist.mit.edu">MITProject Athena</ulink>

<ulink url="http://web.mit.edu/kerberos/www/">MITKerberos page</ulink>

can be a good starting point for exploration.

Several sources for <productname>Kerberos</> distributions exist.

</para>

While <productname>PostgreSQL</> supports both Kerberos 4 and

Kerberos 5, only Kerberos 5 is recommended. Kerberos 4 is

considered insecure and no longer recommended for general

use.

</para>

<para>

In order to use <productname>Kerberos</>, support for it must be

enabled at build time. See <xref linkend="installation"> for more

information. Both Kerberos 4 and 5 are supported, but only one

version can be supported in any one build.

use. Only one version of Kerberos can be supported in any one

build, and support must be enabled at build time. See

<xref linkend="installation"> for more information.

</para>

<para>

<productname>PostgreSQL</> operates like a normal Kerberos service.

The name of the service principal is

<literal><replaceable>servicename</>/<replaceable>hostname</>@<replaceable>realm</></literal>, where

<replaceable>servicename</> is <literal>postgres</literal> (unless a

different service name was selected at configure time with

<literal>./configure --with-krb-srvnam=whatever</>).

<literal><replaceable>servicename</>/<replaceable>hostname</>@<replaceable>realm</></literal>.

</para>

<para>

<replaceable>servicename</> can be set on the server side using the

<xref linkend="guc-krb-srvname"> configuration parameter, and on the

client side using the krbsrvname connection parameter. (See also <xref linkend="libpq-connect">.). The installation default can be changed from the default

<literal>postgres</literal> at build time using

<literal>./configure --with-krb-srvnam=whatever</>). In most environments,

this parameter never needs to be changed. However, to support multiple

<productname>PostgreSQL</> installations on the same host it is necessary.

Some Kerberos implementations may also require a different service name,

such as Microsoft Active Directory which requires the service name

to be in uppercase (<literal>POSTGRES</literal>).

</para>

<para>

<replaceable>hostname</> is the fully qualified host name of the

server machine. The service principal's realm is the preferred realm

of the server machine.

</para>

<para>

Make sure that your serverkey file is readable (and preferably

Make sure that your serverkeytab file is readable (and preferably

only readable) by the <productname>PostgreSQL</productname> server

account. (See also <xref linkend="postgres-user">.) The location

of the key file is specified by the <xref

linkend="guc-krb-server-keyfile"> configuration

parameter.(See also <xref linkend="runtime-config">.)The default

parameter. The default

is <filename>/etc/srvtab</> if you are using Kerberos 4 and

<filename>/usr/local/pgsql/etc/krb5.keytab</> (or whichever

directory was specified as <varname>sysconfdir</> at build time)

with Kerberos 5.

</para>

<para>

To generate the keytab file, use for example (with version 5)

The keytab file is generated in the Kerberos system, see the

Kerberos documentation for details. The following example is

for MIT-compatible Kerberos 5 implementations:

<screen>

<prompt>kadmin% </><userinput>ank -randkey postgres/server.my.domain.org</>

<prompt>kadmin% </><userinput>ktadd -k krb5.keytab postgres/server.my.domain.org</>

</screen>

Read the <productname>Kerberos</> documentation for details.

</para>

<para>

<!-- $PostgreSQL: pgsql/doc/src/sgml/installation.sgml,v 1.233 2005/05/15 00:26:18 momjian Exp $ -->

<!-- $PostgreSQL: pgsql/doc/src/sgml/installation.sgml,v 1.234 2005/06/04 20:42:41 momjian Exp $ -->

<chapter id="installation">

<title><![%standalone-include[<productname>PostgreSQL</>]]>

<term><option>--with-krb-srvnam=<replaceable>NAME</></option></term>

<listitem>

<para>

The name of the Kerberos service principal.

<literal>postgres</literal> is the default. There'sprobably no

Thedefaultname of the Kerberos service principal.

<literal>postgres</literal> is the default. There'susually no

reason to change this.

</para>

</listitem>

<!--

$PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.181 2005/05/30 19:32:44 momjian Exp $

$PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.182 2005/06/04 20:42:41 momjian Exp $

-->

<chapter id="libpq">

</listitem>

</varlistentry>

<varlistentry>

<term><literal>krbsrvname</literal></term>

<listitem>

<para>

Kerberos service name to use when authenticating with Kerberos 4 or 5.

This must match the service name specified in the server

configuration for Kerberos authentication to succeed. (See also

<xref linkend="kerberos-auth">.)

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>service</literal></term>

<listitem>

</listitem>

<listitem>

<para>

<indexterm>

<primary><envar>PGKRBSRVNAME</envar></primary>

</indexterm>

<envar>PGKRBSRVNAME</envar> sets the Kerberos service name to use when

authenticating with Kerberos 4 or 5.

</para>

</listitem>

<listitem>

<para>

<indexterm>

<primary><envar>PGCONNECT_TIMEOUT</envar></primary>

</indexterm>

<!--

$PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.321 2005/05/25 02:56:15 neilc Exp $

$PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.322 2005/06/04 20:42:41 momjian Exp $

-->

<chapter Id="runtime">

<listitem>

<para>

Sets the location of the Kerberos server key file. See

<xref linkend="kerberos-auth"> for details.

<xref linkend="kerberos-auth"> for details. This parameter

can only be set at server start.

</para>

</listitem>

</varlistentry>

<varlistentry id="guc-krb-srvname" xreflabel="krb_srvname">

<term><varname>krb_srvname</varname> (<type>string</type>)</term>

<indexterm>

<primary><varname>krb_srvname</> configuration parameter</primary>

</indexterm>

<listitem>

<para>

Sets the Kerberos service name. See <xref linkend="kerberos-auth">

for details. This parameter can only be set at server start.

</para>

</listitem>

</varlistentry>

<varlistentry id="guc-krb-caseins-users" xreflabel="krb_caseins_users">

<term><varname>krb_caseins_users</varname> (<type>boolean</type>)</term>

<indexterm>

<primary><varname>krb_caseins_users</varname> configuration parameter</primary>

</indexterm>

<listitem>

<para>

Sets if Kerberos usernames should be treated case-insensitive.

The default is off (case sensitive). This parameter can only be

set at server start.

</para>

</listitem>

</varlistentry>

<varlistentry id="guc-db-user-namespace" xreflabel="db_user_namespace">

<term><varname>db_user_namespace</varname> (<type>boolean</type>)</term>

<indexterm>

staticintrecv_and_check_password_packet(Port*port);

char*pg_krb_server_keyfile;

char*pg_krb_srvnam;

boolpg_krb_caseins_users;

status=krb_recvauth(krbopts,

port->sock,

&clttkt,

PG_KRB_SRVNAM,

pg_krb_srvnam,

instance,

&port->raddr.in,

&port->laddr.in,

returnSTATUS_ERROR;

}

retval=krb5_sname_to_principal(pg_krb5_context,NULL,PG_KRB_SRVNAM,

retval=krb5_sname_to_principal(pg_krb5_context,NULL,pg_krb_srvnam,

KRB5_NT_SRV_HST,&pg_krb5_server);

if (retval)

{

ereport(LOG,

(errmsg("Kerberos sname_to_principal(\"%s\") returned error %d",

PG_KRB_SRVNAM,retval)));

pg_krb_srvnam,retval)));

com_err("postgres",retval,

"while getting server principal for service \"%s\"",

PG_KRB_SRVNAM);

pg_krb_srvnam);

krb5_kt_close(pg_krb5_context,pg_krb5_keytab);

krb5_free_context(pg_krb5_context);

returnSTATUS_ERROR;

returnret;

retval=krb5_recvauth(pg_krb5_context,&auth_context,

(krb5_pointer)&port->sock,PG_KRB_SRVNAM,

(krb5_pointer)&port->sock,"postgres",

pg_krb5_server,0,pg_krb5_keytab,&ticket);

if (retval)

{

}

kusername=pg_an_to_ln(kusername);

if (strncmp(port->user_name,kusername,SM_DATABASE_USER))

if (pg_krb_caseins_users)

ret=strncasecmp(port->user_name,kusername,SM_DATABASE_USER);

ret=strncmp(port->user_name,kusername,SM_DATABASE_USER);

if (ret)

{

ereport(LOG,

(errmsg("unexpected Kerberos user name received from client (received \"%s\", expected \"%s\")",

#definePG_KRB_SRVTAB ""

#definePG_KRB_SRVNAM ""

#defineCONFIG_FILENAME"postgresql.conf"

#defineHBA_FILENAME"pg_hba.conf"

},

{

{"krb_caseins_users",PGC_POSTMASTER,CONN_AUTH_SECURITY,

gettext_noop("Sets if Kerberos user names should be treated case insensitive."),

},

&pg_krb_caseins_users,

false,NULL,NULL

},

{

{NULL,0,0,NULL,NULL},NULL, false,NULL,NULL

PG_KRB_SRVTAB,NULL,NULL

},

{

{"krb_srvname",PGC_POSTMASTER,CONN_AUTH_SECURITY,

gettext_noop("Sets the name of the Kerberos service."),

},

&pg_krb_srvnam,

PG_KRB_SRVNAM,NULL,NULL

},

{

{"bonjour_name",PGC_POSTMASTER,CONN_AUTH_SETTINGS,

gettext_noop("Sets the Bonjour broadcast service name."),

#authentication_timeout = 60# 1-600, in seconds

#ssl = false

#password_encryption = true

#krb_server_keyfile = ''

#db_user_namespace = false

# Kerberos

#krb_server_keyfile = ''

#krb_caseins_users = false

#krb_srvname = 'postgres'

#---------------------------------------------------------------------------

#definePG_KRB5_VERSION "PGVER5.1"

externchar*pg_krb_server_keyfile;

externchar*pg_krb_srvnam;

externboolpg_krb_caseins_users;