aboutsummaryrefslogtreecommitdiff
path: root/src/backend/libpq/auth.c
Commit message (Collapse)AuthorAge
* Rewrite pam_passwd_conv_proc to be more robust: avoid assuming that theTom Lane2009-10-16
| | | | | | | | | | | | | | pam_message array contains exactly one PAM_PROMPT_ECHO_OFF message. Instead, deal with however many messages there are, and don't throw error for PAM_ERROR_MSG and PAM_TEXT_INFO messages. This logic is borrowed from openssh 5.2p1, which hopefully has seen more real-world PAM usage than we have. Per bug #5121 from Ryan Douglas, which turned out to be caused by the conv_proc being called with zero messages. Apparently that is normal behavior given the combination of Linux pam_krb5 with MS Active Directory as the domain controller. Patch all the way back, since this code has been essentially untouched since 7.4. (Surprising we've not heard complaints before.)
* Rename the new MAX_AUTH_TOKEN_LENGTH #define to PG_MAX_AUTH_MAX_TOKEN_LENGTH,Heikki Linnakangas2009-10-14
| | | | | to make it more obvious that it's a PostgreSQL internal limit, not something that comes from system header files.
* Raise the maximum authentication token (Kerberos ticket) size in GSSAPIHeikki Linnakangas2009-10-14
| | | | | | | | and SSPI athentication methods. While the old 2000 byte limit was more than enough for Unix Kerberos implementations, tickets issued by Windows Domain Controllers can be much larger. Ian Turner
* Disallow empty passwords in LDAP authentication, the same wayMagnus Hagander2009-06-25
| | | | we already do it for PAM.
* 8.4 pgindent run, with new combined Linux/FreeBSD/MinGW typedef listBruce Momjian2009-06-11
| | | | provided by Andrew.
* Properly return the usermap result when doing gssapi authentication. WithoutMagnus Hagander2009-05-27
| | | | | this, the username was in practice never matched against the kerberos principal used to log in.
* Remove last references to the crypt auth method, per Andreas Scherbaum.Tom Lane2009-04-01
|
* Clean up pg_SSPI_error() coding a little bit: make the messages moreTom Lane2009-03-22
| | | | | consistent, translate where intended, const-ify declarations. Resolves a gripe from Alvaro as well as some stuff I didn't like.
* Make krb_realm and krb_server_hostname be pg_hba options only, and removeMagnus Hagander2009-01-09
| | | | | | | their GUCs. In passing, noted that the pg_hba options for krb5 authentication weren't listed at all - so add this.
* Add hba parameter include_realm to krb5, gss and sspi authentication, usedMagnus Hagander2009-01-07
| | | | | | to pass the full username@realm string to the authentication instead of just the username. This makes it possible to use pg_ident.conf to authenticate users from multiple realms as different database users.
* Allow krb_realm (krb5, gssapi and sspi) and krb_server_hostname (krb5 only)Magnus Hagander2009-01-07
| | | | | authentication options to be set in pg_hba.conf on a per-line basis, to override the defaults set in postgresql.conf.
* Update copyright for 2009.Bruce Momjian2009-01-01
|
* Issue a proper error message when MD5 is attempted whenBruce Momjian2008-11-20
| | | | | | db_user_namespace is enabled. Also document this limitation.
* Add support for using SSL client certificates to authenticate to theMagnus Hagander2008-11-20
| | | | database (only for SSL connections, obviously).
* Control client certificate requesting with the pg_hba option "clientcert"Magnus Hagander2008-11-20
| | | | instead of just relying on the root certificate file to be present.
* Ident authentication over Unix-domain sockets on Solaris, usingPeter Eisentraut2008-11-18
| | | | | | getpeerucred() function. Author: Garick Hamlin <ghamlin@isc.upenn.edu>
* Remove support for (insecure) crypt authentication.Magnus Hagander2008-10-28
| | | | This breaks compatibility with pre-7.2 versions.
* * make pg_hba authoption be a set of 0 or more name=value pairsMagnus Hagander2008-10-23
| | | | | | | | | | | | * make LDAP use this instead of the hacky previous method to specify the DN to bind as * make all auth options behave the same when they are not compiled into the server * rename "ident maps" to "user name maps", and support them for all auth methods that provide an external username This makes a backwards incompatible change in the format of pg_hba.conf for the ident, PAM and LDAP authentication methods.
* Parse pg_hba.conf in postmaster, instead of once in each backend forMagnus Hagander2008-09-15
| | | | | | | | | each connection. This makes it possible to catch errors in the pg_hba file when it's being reloaded, instead of silently reloading a broken file and failing only when a user tries to connect. This patch also makes the "sameuser" argument to ident authentication optional.
* Rearrange the code in auth.c so that all functions for a single authenticationMagnus Hagander2008-08-01
| | | | | | method is grouped together in a reasonably similar way, keeping the "global shared functions" together in their own section as well. Makes it a lot easier to find your way around the code.
* Move ident authentication code into auth.c along with the other authenciationMagnus Hagander2008-08-01
| | | | routines, leaving hba.c to deal only with processing the HBA specific files.
* Fix parsing of LDAP URLs so it doesn't reject spaces in the "suffix" part.Tom Lane2008-07-24
| | | | Per report from César Miguel Oliveira Alves.
* Since GSSAPI and SSPI authentication don't work in protocol version 2,Tom Lane2008-02-08
| | | | | | issue a helpful error message instead of sending unparsable garbage. (It is clearly a design error that this doesn't work, but fixing it is not worth the trouble at this point.) Per discussion.
* Don't putenv() a string that is allocated in a context that will go awayTom Lane2008-01-30
| | | | | soon. I suspect this explains bug #3902, though I'm still not able to reproduce that.
* Update copyrights in source tree to 2008.Bruce Momjian2008-01-01
|
* Fix typoPeter Eisentraut2007-11-28
|
* correct capitalizationPeter Eisentraut2007-11-27
|
* pgindent run for 8.3.Bruce Momjian2007-11-15
|
* Message improvementsPeter Eisentraut2007-11-15
|
* Add parameter krb_realm used by GSSAPI, SSPI and KerberosMagnus Hagander2007-11-09
| | | | | | | to validate the realm of the connecting user. By default it's empty meaning no verification, which is the way Kerberos authentication has traditionally worked in PostgreSQL.
* Fix GSS API pointer checking.Bruce Momjian2007-09-14
| | | | Kris Jurka
* Make it possible, and default, for MingW to build with SSPI supportMagnus Hagander2007-07-24
| | | | | by dynamically loading the function that's missing from the MingW headers and library.
* SSPI authentication on Windows. GSSAPI compatible client when doing KerberosMagnus Hagander2007-07-23
| | | | | | | against a Unix server, and Windows-specific server-side authentication using SSPI "negotiate" method (Kerberos or NTLM). Only builds properly with MSVC for now.
* Fix some warnings (probably actual bugs) generated by new GSSAPI codeTom Lane2007-07-12
| | | | when built on a 64-bit machine. Per buildfarm results extracted by Stefan.
* Enable GSSAPI to build using MSVC. Always build GSSAPI when Kerberos isMagnus Hagander2007-07-12
| | | | enabled, because the only Kerberos library supported always contains it.
* Support GSSAPI builds where the header is <gssapi.h> and not <gssapi/gssapi.h>,Magnus Hagander2007-07-12
| | | | | | such as OpenBSD (possibly all Heimdal). Stefan Kaltenbrunner
* A bunch of GSSAPI fixes per comments from Tom:Magnus Hagander2007-07-11
| | | | | | * use elog not ereport for debug * fix debug levels for some output * properly check for memory allocation errors in a couple of missed places
* Add support for GSSAPI authentication.Magnus Hagander2007-07-10
| | | | | | Documentation still being written, will be committed later. Henry B. Hotz and Magnus Hagander
* Check if the role exists before doing more complex ident and KerberosBruce Momjian2007-02-08
| | | | | | authentication checks in the backend. Gavin Sherry
* Update CVS HEAD for 2007 copyright. Back branches are typically notBruce Momjian2007-01-05
| | | | back-stamped for this.
* Minor fix for LDAP authentication: if an error occurs, we need toNeil Conway2006-11-06
| | | | | | | | | | | | manually release the LDAP handle via ldap_unbind(). This isn't a significant problem in practice because an error eventually results in exiting the process, but we can cleanup correctly without too much pain. In passing, fix an error in snprintf() usage: the "size" parameter to snprintf() is the size of the destination buffer, including space for the NUL terminator. Also, depending on the value of NAMEDATALEN, the old coding could have allowed for a buffer overflow.
* Message style improvementsPeter Eisentraut2006-10-06
|
* pgindent run for 8.2.Bruce Momjian2006-10-04
|
* Make some sentences consistent with similar ones.Bruce Momjian2006-10-03
| | | | Euler Taveira de Oliveira
* Remove WINLDAPAPI decoration from ldap_start_tls_sA typedef, per Magnus.Tom Lane2006-09-15
|
* Ooops, ldap fix for win32 broke the non-win32 case.Tom Lane2006-08-22
|
* Fix encrypted-LDAP support so that it doesn't cause the server to failTom Lane2006-08-21
| | | | | entirely on older Windows platforms without the needed library function. Magnus Hagander
* Remove 576 references of include files that were not needed.Bruce Momjian2006-07-14
|
* Fix a passel of recently-committed violations of the rule 'thou shaltTom Lane2006-07-14
| | | | | have no other gods before c.h'. Also remove some demonstrably redundant #include lines, mostly of <errno.h> which was added to c.h years ago.
* Allow include files to compile own their own.Bruce Momjian2006-07-13
| | | | | | | Strip unused include files out unused include files, and add needed includes to C files. The next step is to remove unused include files in C files.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-05 05:20:44 +0000