Bug 83780 - sspi / gssapi login from Windows Client to Linux (Samba4) PostgreSQL server
Summary: sspi / gssapi login from Windows Client to Linux (Samba4) PostgreSQL server
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Documentation (show other bugs)
Version:
(earliest affected)
4.3.1.2 release
Hardware: x86-64 (AMD64) All
: medium enhancement
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-09-11 20:41 UTC by Michael J Evans
Modified: 2015-10-31 13:03 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Michael J Evans 2014-09-11 20:41:53 UTC
Client: A 64 bit Windows 7 host logged in to a domain; LibreOffice 4.3.1.2; native 64 bit PostgreSQL driver has been installed.
Server: (Generic Debian Linux with) PostgreSQL 9.4beta2

Server messages

2014-09-11 20:36:10 UTC [26574-1] michael.evans@postgres LOG:  08006: could not receive data from client: Connection reset by peer
2014-09-11 20:36:10 UTC [26574-2] michael.evans@postgres LOCATION:  pq_recvbuf, pqcomm.c:869
2014-09-11 20:36:10 UTC [26574-3] michael.evans@postgres FATAL:  28000: GSSAPI authentication failed for user "michael.evans"
2014-09-11 20:36:10 UTC [26574-4] michael.evans@postgres DETAIL:  Connection matched pg_hba.conf line 101: "host        all             all             0.0.0.0/0               gss"
2014-09-11 20:36:10 UTC [26574-5] michael.evans@postgres LOCATION:  auth_failed, auth.c:285


Client messages

Couldn't establish database connection to 'sdbc:postgresql:host=EXAMPLE dbname=postgres'
SSPI continuation error: The specified target is unknown or unreachable (80090303)


When on a different Samaba4 AD member than the postgresql server I kinit to the same domain account and connect using psql GSSAPI authentication is successful.

psql -h v-s4 -U michael.evans -d postgres


Additionally, I have not yet been able to locate an official up to date guide for establishing such a connection.  Older versions mention a gsslib connection parameter but that appears to be invalid with this version of LibreOffice/PostgreSQL.
Comment 1 Michael J Evans 2014-09-11 21:28:11 UTC
This should probably be altered to a lower priority additional documentation request.  I decided to try getting pgAdmin III to work in the same environment and a more helpful remark there allowed me to understand the issue.

When using sspi/gssapi the FQDN of the service must be used, not just a hostname that works in the default search domain(s).


host=host.domain.example.com dbname=DBNAME


The username, if left blank, usefully infers your domain login name (prior to the @ part).

DBNAME is whatever database you are connecting to; for testing I was using postgres (the built in informational for database database).
Comment 2 Alex Thurgood 2014-10-21 09:14:07 UTC
Setting to documentation enhancement
Comment 3 Alex Thurgood 2015-01-03 17:39:21 UTC Comment hidden (no-value)