I am trying to authenticate to Postgres with Kerberos using S4U2 delegation with a service principle impersonating the user. I have delegated the principal 'HTTP/sp01.domain' to login as 'username' using S4U2. I am performing the following steps:
kdestroy -A kinit -kt /etc/httpd/conf/httpd.keytab HTTP/sp01.domain kvno -k /etc/httpd/conf/httpd.keytab -U username -P HTTP/sp01.domain postgres/db01.domain klist Ticket cache: KEYRING:persistent:0:krb_ccache_mqdrewy Default principal: HTTP/sp01.domain psql -h db01.domain -d test_db -U username FATAL: GSSAPI authentication failed for user "username" LOG: provided user name (username) and authenticated user name (HTTP/sp01.domain) do not match
If i set the map like this, the authentication succeeds:
testmap HTTP/sp01.domain username
But the issue is that service principle 'HTTP/sp01.domain' has to impersonate as different users and each user has to be identified uniquely at Postgres level.
The issue seems to be that KRB5/GSSAPI authentication fails when user != principal (http://www.postgresql-archive.org/BUG-4824-KRB5-GSSAPI-authentication-fails-when-user-principal-td2129227.html)
How can I get Postgres to authenticate with a delegated user using S4U2?