diff options
Diffstat (limited to 'doc/src/sgml/runtime.sgml')
| -rw-r--r-- | doc/src/sgml/runtime.sgml | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml index 17e938148c5..283352d3a4a 100644 --- a/doc/src/sgml/runtime.sgml +++ b/doc/src/sgml/runtime.sgml @@ -2563,7 +2563,7 @@ openssl x509 -req -in server.csr -text -days 365 \ <productname>PostgreSQL</productname> also has native support for using <acronym>GSSAPI</acronym> to encrypt client/server communications for increased security. Support requires that a <acronym>GSSAPI</acronym> - implementation (such as MIT krb5) is installed on both client and server + implementation (such as MIT Kerberos) is installed on both client and server systems, and that support in <productname>PostgreSQL</productname> is enabled at build time (see <xref linkend="installation"/>). </para> @@ -2583,6 +2583,16 @@ openssl x509 -req -in server.csr -text -days 365 \ </para> <para> + When using <acronym>GSSAPI</acronym> for encryption, it is common to + use <acronym>GSSAPI</acronym> for authentication as well, since the + underlying mechanism will determine both client and server identities + (according to the <acronym>GSSAPI</acronym> implementation) in any + case. But this is not required; + another <productname>PostgreSQL</productname> authentication method + can be chosen to perform additional verification. + </para> + + <para> Other than configuration of the negotiation behavior, <acronym>GSSAPI</acronym> encryption requires no setup beyond that which is necessary for GSSAPI authentication. (For more information |