Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2014-02-21 Thread Brian Crowell
Thought I might add, now that I've had more time to work with it, that adding the PostgreSQL host to the domain isn't necessary, and at least with Samba 3 is a huge waste of time thanks to the machine password changing policies in Active Directory. Much better to create an ordinary user account

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-12 Thread Francisco Figueiredo Jr.
Em 12/11/2013 03:37, Brian Crowell br...@fluggo.com escreveu: On Mon, Nov 11, 2013 at 10:51 PM, Brian Crowell br...@fluggo.com wrote: I think I'm getting closer though. I have psql on Windows successfully authenticating, so I can't be too far off. Got it. The NpgsqlPasswordPacket class

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-12 Thread Magnus Hagander
On Tue, Nov 12, 2013 at 6:56 AM, Christian Ullrich ch...@chrullrich.netwrote: * From: Brian Crowell On Mon, Nov 11, 2013 at 10:51 PM, Brian Crowell br...@fluggo.com wrote: I think I'm getting closer though. I have psql on Windows successfully authenticating, so I can't be too far off.

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-12 Thread Brian Crowell
On Tue, Nov 12, 2013 at 5:45 AM, Francisco Figueiredo Jr. franci...@npgsql.org wrote: It would be awesome if you could write a little guide about how to configure PostgreSQL to work with sspi authentication from Windows. I could add it to our Npgsql user manual... A guide will have to wait

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-12 Thread Brian Crowell
On Tue, Nov 12, 2013 at 9:13 AM, Brian Crowell br...@fluggo.com wrote: net ads keytab add postgres/machinen...@realm.com -U DOMAIN\Administrator net ads keytab add postgres/machinename.domain@realm.com -U DOMAIN\Administrator D'oh! These should be: net ads keytab add

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-12 Thread Brian Crowell
On Mon, Nov 11, 2013 at 11:56 PM, Christian Ullrich ch...@chrullrich.net wrote: On Mon, Nov 11, 2013 at 10:51 PM, Brian Crowell br...@fluggo.com wrote: * If I don't specify my username, Npgsql sends it in lowercase bcrowell Hmm. That is related one problem I've been having with SSPI auth from

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-12 Thread Christian Ullrich
* From: Brian Crowell On Mon, Nov 11, 2013 at 11:56 PM, Christian Ullrich ch...@chrullrich.net wrote: On Mon, Nov 11, 2013 at 10:51 PM, Brian Crowell br...@fluggo.com wrote: * If I don't specify my username, Npgsql sends it in lowercase bcrowell Hmm. That is related one problem I've

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-12 Thread Brian Crowell
On Tue, Nov 12, 2013 at 10:03 AM, Christian Ullrich ch...@chrullrich.net wrote: Pseudocode: n = GetUserNameEx(NameSamCompatible)// logon screen case NameTranslate.Set(ADS_NAME_TYPE_NT4, n) n = NameTranslate.Get(ADS_NAME_TYPE_DOMAIN_SIMPLE) // official case n =

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-12 Thread Brian Crowell
On Tue, Nov 12, 2013 at 5:45 AM, Francisco Figueiredo Jr. franci...@npgsql.org wrote: I'm looking forward your patch. Npgsql source can be found at github.com/npgsql/Npgsql I figured out the username issue, and so I've sent a pull request: https://github.com/npgsql/Npgsql/pull/95 I encountered

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-12 Thread Francisco Figueiredo Jr.
On Tue, Nov 12, 2013 at 4:17 PM, Brian Crowell br...@fluggo.com wrote: On Tue, Nov 12, 2013 at 5:45 AM, Francisco Figueiredo Jr. franci...@npgsql.org wrote: I'm looking forward your patch. Npgsql source can be found at github.com/npgsql/Npgsql I figured out the username issue, and so I've

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-11 Thread Brian Crowell
On Tue, Nov 5, 2013 at 11:35 AM, Christian Ullrich ch...@chrullrich.net wrote: Hence my suspicion that it doesn't. I did not have the time to compare every function call yet. It doesn't. But it's a pretty close match; it looks like it was ported directly from the libpq code. libpq actually uses

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-11 Thread Brian Crowell
On Mon, Nov 11, 2013 at 10:51 PM, Brian Crowell br...@fluggo.com wrote: I think I'm getting closer though. I have psql on Windows successfully authenticating, so I can't be too far off. Got it. The NpgsqlPasswordPacket class has a bug: a utility function it calls appends a null character to

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-11 Thread Christian Ullrich
* From: Brian Crowell On Mon, Nov 11, 2013 at 10:51 PM, Brian Crowell br...@fluggo.com wrote: I think I'm getting closer though. I have psql on Windows successfully authenticating, so I can't be too far off. Got it. Great! The NpgsqlPasswordPacket class has a bug: a utility function it

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-05 Thread Christian Ullrich
* Stephen Frost wrote: * Brian Crowell (br...@fluggo.com) wrote: However, the eventual goal was to connect to this same server from a .NET app running on Windows, and here I've run into a snag. The Npgsql library does not support GSSAPI—it only supports SSPI, which is

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-05 Thread Stephen Frost
* Christian Ullrich (ch...@chrullrich.net) wrote: I tried to fix it using the reverse of they one-line fix that worked in both JDBC and libpq. There, the problem was that they only supported GSSAPI and had no clue about SSPI (except libpq on Windows). The fix was to basically declare GSSAPI

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-05 Thread Christian Ullrich
* Stephen Frost wrote: * Christian Ullrich (ch...@chrullrich.net) wrote: I tried to fix it using the reverse of they one-line fix that worked in both JDBC and libpq. There, the problem was that they only supported GSSAPI and had no clue about SSPI (except libpq on Windows). The fix was to

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-05 Thread Francisco Figueiredo Jr.
On Tue, Nov 5, 2013 at 2:35 PM, Christian Ullrich ch...@chrullrich.netwrote: * Stephen Frost wrote: * Brian Crowell (br...@fluggo.com) wrote: However, the eventual goal was to connect to this same server from a .NET app running on Windows, and here I've run into a snag. The Npgsql library

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-05 Thread Christian Ullrich
* Francisco Figueiredo Jr. wrote: On Tue, Nov 5, 2013 at 2:35 PM, Christian Ullrich ch...@chrullrich.net mailto:ch...@chrullrich.net wrote: * Stephen Frost wrote: * Brian Crowell (br...@fluggo.com mailto:br...@fluggo.com) wrote: However, the eventual goal was to

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-05 Thread Christian Ullrich
* Christian Ullrich wrote: Nov 1 10:31:50 infra1 postgres[25277]: [7-1] FATAL: accepting GSS security context failed Nov 1 10:31:50 infra1 postgres[25277]: [7-2] DETAIL: An unsupported mechanism was requested: Unknown error Nov 1 10:39:31 infra1 postgres[25587]: [7-1] FATAL: accepting GSS

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-11-03 Thread Stephen Frost
Brian, * Brian Crowell (br...@fluggo.com) wrote: However, the eventual goal was to connect to this same server from a .NET app running on Windows, and here I've run into a snag. The Npgsql library does not support GSSAPI—it only supports SSPI, which is nearly-but-not-enough-like the same

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-10-31 Thread Merlin Moncure
On Wed, Oct 30, 2013 at 3:16 PM, Brian Crowell br...@fluggo.com wrote: Hello again! I've been setting up my PostgreSQL server by doing something I've never done before: I've joined a Linux server to a domain so I can use integrated Kerberos authentication from server to server. I've managed

[GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-10-30 Thread Brian Crowell
Hello again! I've been setting up my PostgreSQL server by doing something I've never done before: I've joined a Linux server to a domain so I can use integrated Kerberos authentication from server to server. I've managed to make this work from Linux machine to Linux machine. On the client, I

Re: [GENERAL] GSSAPI server side on Linux, SSPI client side on Windows

2013-10-30 Thread Brian Crowell
I've thought of one option, which I'm investigating: implementing GSSAPI support in Npgsql. Microsoft claims this is possible using the SSPI API: http://msdn.microsoft.com/en-us/library/windows/desktop/aa380496(v=vs.85).aspx —Brian On Wed, Oct 30, 2013 at 3:16 PM, Brian Crowell br...@fluggo.com