Re: SSPI authentication - patch

* Magnus Hagander (magnus@hagander.net) wrote:
> Here's an updated version of this patch. This version has full SSPI support
> in the server as well, so I can do both kerberos and NTLM between two
> windows machines using the negotiate method.

Great!  Also, I've tested that it works under Windows using
PGGSSLIB=gssapi with the MIT GSS libraries.  I did have to set the
PGKRBSRVNAME to 'postgres'.  It worked excellently. :)

> Since SSPI and GSSAPI can now both be used, my plan is not to have an
> autoconf to disable SSPI, but to just enable it unconditionally on win32.
> Or does this seem like a bad idea?

My thinking would be to have the autoconf to disable it, but enable it
by default.  I don't feel particularly strongly about it though.

> Comments welcome.

It looks good in general to me (though I'm not super-familiar with
SSPI).  My one big concern is this:

>   /* Define to the name of the default PostgreSQL service principal in Kerberos.
>      (--with-krb-srvnam=NAME) */
> ! #define PG_KRB_SRVNAM "postgres"
>
>   /* A string containing the version number, platform, and C compiler */
>   #define PG_VERSION_STR "Uninitialized version string (win32)"
> --- 582,588 ----
>
>   /* Define to the name of the default PostgreSQL service principal in Kerberos.
>      (--with-krb-srvnam=NAME) */
> ! #define PG_KRB_SRVNAM "POSTGRES"

I understand that SSPI is case-insensitive, or folds to uppercase, or
whatever, but this is *not* used only by the SSPI code.  Please correct
me if I'm wrong, but this will break existing krb-auth using client
applications/setups that went with the previous default, no?  I realize
it's on Windows, but there are people out there with that
configuration (yes, like me... :)...

I don't particularly like it but, honestly, it seems like it might be
better to set it based on what's being used (GSSAPI/SSPI/KRB5)?  This
would be for the client-side, as I guess we've decided it's okay to just
pick whatever keytab the users provide that's in our server-side
keytab.

    Thanks again!

        Stephen