I am trying to authenticate to Postgres with Kerberos using S4U2 delegation with a service principle impersonating the user. I have delegated the principal 'HTTP/sp01.domain' to login as 'username' using S4U2. I am performing the following steps:

kdestroy -A

kinit -kt /etc/httpd/conf/httpd.keytab HTTP/sp01.domain

kvno -k /etc/httpd/conf/httpd.keytab -U username -P HTTP/sp01.domain postgres/db01.domain


Ticket cache: KEYRING:persistent:0:krb_ccache_mqdrewy
Default principal: HTTP/sp01.domain

psql -h db01.domain -d test_db -U username

FATAL:  GSSAPI authentication failed for user "username"
LOG:  provided user name (username) and authenticated user name
(HTTP/sp01.domain) do not match

If i set the map like this, the authentication succeeds:

testmap HTTP/sp01.domain username

But the issue is that service principle 'HTTP/sp01.domain' has to impersonate as different users and each user has to be identified uniquely at Postgres level.

The issue seems to be that KRB5/GSSAPI authentication fails when user != principal (http://www.postgresql-archive.org/BUG-4824-KRB5-GSSAPI-authentication-fails-when-user-principal-td2129227.html)

How can I get Postgres to authenticate with a delegated user using S4U2?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.