Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 954f6bc

Browse files
bmomjianbmomjian
committed
Add GUC krb_server_hostname so the server hostname can be specified as
part of service principal. If not set, any service principal matching an entry in the keytab can be used. NEW KERBEROS MATCHING BEHAVIOR FOR 8.1. Todd Kover
1 parent dac94e3 commit 954f6bc

File tree

5 files changed

+66
-31
lines changed

5 files changed

+66
-31
lines changed

‎doc/src/sgml/runtime.sgml

+33-13
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.325 2005/06/13 02:40:06 neilc Exp $
2+
$PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.326 2005/06/14 17:43:12 momjian Exp $
33
-->
44

55
<chapter Id="runtime">
@@ -969,24 +969,44 @@ SET ENABLE_SEQSCAN TO OFF;
969969
<listitem>
970970
<para>
971971
Sets the Kerberos service name. See <xref linkend="kerberos-auth">
972-
for details. This parameter can only be set at server start.
972+
for details. This parameter can only be set at server start.
973973
</para>
974974
</listitem>
975975
</varlistentry>
976976

977-
<varlistentry id="guc-krb-caseins-users" xreflabel="krb_caseins_users">
978-
<term><varname>krb_caseins_users</varname> (<type>boolean</type>)</term>
979-
<indexterm>
980-
<primary><varname>krb_caseins_users</varname> configuration parameter</primary>
977+
<varlistentry id="guc-krb-caseins-users" xreflabel="krb_caseins_users">
978+
<term><varname>krb_caseins_users</varname> (<type>boolean</type>)</term>
979+
<indexterm>
980+
<primary><varname>krb_caseins_users</varname> configuration parameter</primary>
981981
</indexterm>
982-
<listitem>
983-
<para>
984-
Sets if Kerberos usernames should be treated case-insensitive.
985-
The default is off (case sensitive). This parameter can only be
986-
set at server start.
982+
<listitem>
983+
<para>
984+
Sets if Kerberos usernames should be treated case-insensitive.
985+
The default is off (case sensitive). This parameter can only be
986+
set at server start.
987987
</para>
988-
</listitem>
989-
</varlistentry>
988+
</listitem>
989+
</varlistentry>
990+
991+
<varlistentry id="guc-krb-server-hostname" xreflabel="krb_server_hostname">
992+
<term><varname>krb_server_hostname</varname> (<type>string</type>)</term>
993+
<indexterm>
994+
<primary><varname>krb_server_hostname</> configuration parameter</primary>
995+
</indexterm>
996+
<listitem>
997+
<para>
998+
Sets the hostname part of the service principal.
999+
This, combined with <varname>krb_srvname</>, is used to generate
1000+
the complete service principal, i.e.
1001+
<varname>krb_server_hostname</><literal>/</><varname>krb_server_hostname</><literal>@</>REALM.
1002+
</para>
1003+
<para>
1004+
If not set, the default is to allow any service principal matching an entry
1005+
in the keytab. See <xref linkend="kerberos-auth"> for details.
1006+
This parameter can only be set at server start.
1007+
</para>
1008+
</listitem>
1009+
</varlistentry>
9901010

9911011
<varlistentry id="guc-db-user-namespace" xreflabel="db_user_namespace">
9921012
<term><varname>db_user_namespace</varname> (<type>boolean</type>)</term>

‎src/backend/libpq/auth.c

+20-14
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.124 2005/06/04 20:42:42 momjian Exp $
11+
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.125 2005/06/14 17:43:13 momjian Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -43,6 +43,7 @@ static int recv_and_check_password_packet(Port *port);
4343
char *pg_krb_server_keyfile;
4444
char *pg_krb_srvnam;
4545
bool pg_krb_caseins_users;
46+
char *pg_krb_server_hostname = NULL;
4647

4748
#ifdef USE_PAM
4849
#ifdef HAVE_PAM_PAM_APPL_H
@@ -221,20 +222,25 @@ pg_krb5_init(void)
221222
return STATUS_ERROR;
222223
}
223224

224-
retval = krb5_sname_to_principal(pg_krb5_context, NULL, pg_krb_srvnam,
225-
KRB5_NT_SRV_HST, &pg_krb5_server);
226-
if (retval)
225+
if (pg_krb_server_hostname)
227226
{
228-
ereport(LOG,
229-
(errmsg("Kerberos sname_to_principal(\"%s\") returned error %d",
230-
pg_krb_srvnam, retval)));
231-
com_err("postgres", retval,
232-
"while getting server principal for service \"%s\"",
233-
pg_krb_srvnam);
234-
krb5_kt_close(pg_krb5_context, pg_krb5_keytab);
235-
krb5_free_context(pg_krb5_context);
236-
return STATUS_ERROR;
237-
}
227+
retval = krb5_sname_to_principal(pg_krb5_context,
228+
pg_krb_server_hostname, pg_krb_srvnam,
229+
KRB5_NT_SRV_HST, &pg_krb5_server);
230+
if (retval)
231+
{
232+
ereport(LOG,
233+
(errmsg("Kerberos sname_to_principal(\"%s\") returned error %d",
234+
pg_krb_srvnam, retval)));
235+
com_err("postgres", retval,
236+
"while getting server principal for service \"%s\"",
237+
pg_krb_srvnam);
238+
krb5_kt_close(pg_krb5_context, pg_krb5_keytab);
239+
krb5_free_context(pg_krb5_context);
240+
return STATUS_ERROR;
241+
}
242+
} else
243+
pg_krb5_server = NULL;
238244

239245
pg_krb5_initialised = 1;
240246
return STATUS_OK;

‎src/backend/utils/misc/guc.c

+10-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
* Written by Peter Eisentraut <peter_e@gmx.net>.
1111
*
1212
* IDENTIFICATION
13-
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.264 2005/06/04 20:42:42 momjian Exp $
13+
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.265 2005/06/14 17:43:13 momjian Exp $
1414
*
1515
*--------------------------------------------------------------------
1616
*/
@@ -1593,6 +1593,15 @@ static struct config_string ConfigureNamesString[] =
15931593
PG_KRB_SRVNAM, NULL, NULL
15941594
},
15951595

1596+
{
1597+
{"krb_server_hostname", PGC_POSTMASTER, CONN_AUTH_SECURITY,
1598+
gettext_noop("Sets the hostname of the Kerberos server."),
1599+
NULL
1600+
},
1601+
&pg_krb_server_hostname,
1602+
NULL, NULL, NULL
1603+
},
1604+
15961605
{
15971606
{"bonjour_name", PGC_POSTMASTER, CONN_AUTH_SETTINGS,
15981607
gettext_noop("Sets the Bonjour broadcast service name."),

‎src/bin/psql/tab-complete.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
*
44
* Copyright (c) 2000-2005, PostgreSQL Global Development Group
55
*
6-
* $PostgreSQL: pgsql/src/bin/psql/tab-complete.c,v 1.130 2005/05/25 22:12:05 momjian Exp $
6+
* $PostgreSQL: pgsql/src/bin/psql/tab-complete.c,v 1.131 2005/06/14 17:43:14 momjian Exp $
77
*/
88

99
/*----------------------------------------------------------------------
@@ -559,7 +559,6 @@ psql_completion(char *text, int start, int end)
559559
"geqo_selection_bias",
560560
"geqo_threshold",
561561
"join_collapse_limit",
562-
"krb_server_keyfile",
563562
"lc_messages",
564563
"lc_monetary",
565564
"lc_numeric",

‎src/include/libpq/auth.h

+2-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
* Portions Copyright (c) 1996-2005, PostgreSQL Global Development Group
88
* Portions Copyright (c) 1994, Regents of the University of California
99
*
10-
* $PostgreSQL: pgsql/src/include/libpq/auth.h,v 1.27 2005/06/04 20:42:42 momjian Exp $
10+
* $PostgreSQL: pgsql/src/include/libpq/auth.h,v 1.28 2005/06/14 17:43:14 momjian Exp $
1111
*
1212
*-------------------------------------------------------------------------
1313
*/
@@ -29,5 +29,6 @@ extern void ClientAuthentication(Port *port);
2929
extern char *pg_krb_server_keyfile;
3030
extern char *pg_krb_srvnam;
3131
extern bool pg_krb_caseins_users;
32+
extern char *pg_krb_server_hostname;
3233

3334
#endif /* AUTH_H */

0 commit comments

Comments
 (0)