Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit18d0ca2

Browse files
committed
Fix Kerberos authentication in wake of virtual-hosts changes --- need
to call krb5_sname_to_principal() always. Also, use krb_srvname ratherthan the hardwired string 'postgres' as the appl_version string in thekrb5_sendauth/recvauth calls, to avoid breaking compatibility with PG8.0. Magnus Hagander
1 parent4909357 commit18d0ca2

File tree

3 files changed

+30
-23
lines changed

3 files changed

+30
-23
lines changed

‎src/backend/libpq/auth.c

Lines changed: 27 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.127 2005/07/25 04:52:31 tgl Exp $
11+
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.128 2005/10/08 19:32:57 tgl Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -119,6 +119,7 @@ static int
119119
pg_krb5_init(void)
120120
{
121121
krb5_error_coderetval;
122+
char*khostname;
122123

123124
if (pg_krb5_initialised)
124125
returnSTATUS_OK;
@@ -145,25 +146,31 @@ pg_krb5_init(void)
145146
returnSTATUS_ERROR;
146147
}
147148

148-
if (pg_krb_server_hostname)
149+
/*
150+
* If no hostname was specified, pg_krb_server_hostname is already
151+
* NULL. If it's set to blank, force it to NULL.
152+
*/
153+
khostname=pg_krb_server_hostname;
154+
if (khostname&&khostname[0]=='\0')
155+
khostname=NULL;
156+
157+
retval=krb5_sname_to_principal(pg_krb5_context,
158+
khostname,
159+
pg_krb_srvnam,
160+
KRB5_NT_SRV_HST,
161+
&pg_krb5_server);
162+
if (retval)
149163
{
150-
retval=krb5_sname_to_principal(pg_krb5_context,
151-
pg_krb_server_hostname,pg_krb_srvnam,
152-
KRB5_NT_SRV_HST,&pg_krb5_server);
153-
if (retval)
154-
{
155-
ereport(LOG,
156-
(errmsg("Kerberos sname_to_principal(\"%s\") returned error %d",
157-
pg_krb_srvnam,retval)));
158-
com_err("postgres",retval,
159-
"while getting server principal for service \"%s\"",
160-
pg_krb_srvnam);
161-
krb5_kt_close(pg_krb5_context,pg_krb5_keytab);
162-
krb5_free_context(pg_krb5_context);
163-
returnSTATUS_ERROR;
164-
}
165-
}else
166-
pg_krb5_server=NULL;
164+
ereport(LOG,
165+
(errmsg("Kerberos sname_to_principal(\"%s\") returned error %d",
166+
pg_krb_srvnam,retval)));
167+
com_err("postgres",retval,
168+
"while getting server principal for service \"%s\"",
169+
pg_krb_srvnam);
170+
krb5_kt_close(pg_krb5_context,pg_krb5_keytab);
171+
krb5_free_context(pg_krb5_context);
172+
returnSTATUS_ERROR;
173+
}
167174

168175
pg_krb5_initialised=1;
169176
returnSTATUS_OK;
@@ -194,7 +201,7 @@ pg_krb5_recvauth(Port *port)
194201
returnret;
195202

196203
retval=krb5_recvauth(pg_krb5_context,&auth_context,
197-
(krb5_pointer)&port->sock,"postgres",
204+
(krb5_pointer)&port->sock,pg_krb_srvnam,
198205
pg_krb5_server,0,pg_krb5_keytab,&ticket);
199206
if (retval)
200207
{

‎src/backend/utils/misc/postgresql.conf.sample

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@
7070
# Kerberos
7171
#krb_server_keyfile = ''
7272
#krb_srvname = 'postgres'
73-
#krb_server_hostname = '(any)'#if not set, matches any keytab entry
73+
#krb_server_hostname = ''#empty string matches any keytab entry
7474
#krb_caseins_users = off
7575

7676
# - TCP Keepalives -

‎src/interfaces/libpq/fe-auth.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
* exceed INITIAL_EXPBUFFER_SIZE (currently 256 bytes).
1111
*
1212
* IDENTIFICATION
13-
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-auth.c,v 1.103 2005/06/30 01:59:20 neilc Exp $
13+
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-auth.c,v 1.104 2005/10/08 19:32:58 tgl Exp $
1414
*
1515
*-------------------------------------------------------------------------
1616
*/
@@ -280,7 +280,7 @@ pg_krb5_sendauth(char *PQerrormsg, int sock, const char *hostname, const char *s
280280
}
281281

282282
retval=krb5_sendauth(pg_krb5_context,&auth_context,
283-
(krb5_pointer)&sock,"postgres",
283+
(krb5_pointer)&sock,(char*)servicename,
284284
pg_krb5_client,server,
285285
AP_OPTS_MUTUAL_REQUIRED,
286286
NULL,0,/* no creds, use ccache instead */

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp