Re: [BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-14 Thread Heikki Linnakangas
Magnus Hagander wrote: 2009/10/13 Tom Lane t...@sss.pgh.pa.us: Heikki Linnakangas heikki.linnakan...@enterprisedb.com writes: Magnus Hagander wrote: Actually, I found a note that said it's recommended to never increase it about 65535 - so perhaps we should put our limit at that instead od

Re: [BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-14 Thread Heikki Linnakangas
Tom Lane wrote: Peter Eisentraut pete...@gmx.net writes: A small wish in case we go with this: The constant should be named something like PG_...; otherwise it looks like we are defining or overriding an official symbol from the GSS API. I'd be inclined to just s/2000/32767/ and not bother

Re: [BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-14 Thread Turner, Ian
I'll rename it to PG_MAX_AUTH_TOKEN_LENGTH, unless someone has a better suggestion. If we are not changing this for all authentication schemes, then the name should probably reflect that this is for GSS and SSPI only (not even KRB5). --Ian -- Sent via pgsql-bugs mailing list

Re: [BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-14 Thread Tom Lane
Turner, Ian ian.tur...@deshaw.com writes: I'll rename it to PG_MAX_AUTH_TOKEN_LENGTH, unless someone has a better suggestion. If we are not changing this for all authentication schemes, then the name should probably reflect that this is for GSS and SSPI only (not even KRB5). Then we'd have

Re: [BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-14 Thread Turner, Ian
The original naming complaint reflected a concern that the symbol looked like it was supplied by the system headers, rather than being of Postgres origin. Heikki's suggestion deals with that, and I think it's fine as-is. OK, fine with me. --Ian -- Sent via pgsql-bugs mailing list

Re: [BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-13 Thread Heikki Linnakangas
Turner, Ian wrote: While trying to connect our PostgreSQL database to our Kerberos realm, we encountered the obscure message Invalid message length. Tracking this down, we discovered that it was emitted by src/backend/libpq/pqcomm.c in response to a rather large Kerberos message. The root

Re: [BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-13 Thread Magnus Hagander
2009/10/13 Heikki Linnakangas heikki.linnakan...@enterprisedb.com: Turner, Ian wrote: While trying to connect our PostgreSQL database to our Kerberos realm, we encountered the obscure message Invalid message length. Tracking this down, we discovered that it was emitted by

Re: [BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-13 Thread Peter Eisentraut
On Mon, 2009-10-12 at 20:42 -0400, Turner, Ian wrote: --- postgresql-8.4-8.4.1/src/backend/libpq/auth.c 2009-06-25 12:30:08.0 +0100 +++ postgresql-8.4-8.4.1-fixed/src/backend/libpq/auth.c 2009-09-15 20:27:01.0 +0100 @@ -166,6 +166,8 @@ #endif static int

Re: [BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-13 Thread Tom Lane
Peter Eisentraut pete...@gmx.net writes: A small wish in case we go with this: The constant should be named something like PG_...; otherwise it looks like we are defining or overriding an official symbol from the GSS API. I'd be inclined to just s/2000/32767/ and not bother with a symbol,

Re: [BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-13 Thread Bruce Momjian
Peter Eisentraut wrote: On Mon, 2009-10-12 at 20:42 -0400, Turner, Ian wrote: --- postgresql-8.4-8.4.1/src/backend/libpq/auth.c 2009-06-25 12:30:08.0 +0100 +++ postgresql-8.4-8.4.1-fixed/src/backend/libpq/auth.c 2009-09-15 20:27:01.0 +0100 @@ -166,6 +166,8 @@

Re: [BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-13 Thread Turner, Ian
Tom Lane: I'd be inclined to just s/2000/32767/ and not bother with a symbol, Heikki Linnakangas: The corresponding limit in pg_SSPI_recvauth() probably needs to be raised too.. Magnus Hagander: Actually, I found a note that said it's recommended to never increase it [above] 65535 - so

Re: [BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-13 Thread Heikki Linnakangas
Magnus Hagander wrote: FWIW, the default max token size on Win2k is ~8Kb. In some service pack and then in Win2003, it was increased to 12Kb. But it is possible to increase that by a registry key on the domain controller - and I read somewhere that Win2008 actually will increase this size

Re: [BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-13 Thread Tom Lane
Heikki Linnakangas heikki.linnakan...@enterprisedb.com writes: Magnus Hagander wrote: Actually, I found a note that said it's recommended to never increase it about 65535 - so perhaps we should put our limit at that instead od 32767? Yeah, setting it at 65535 seems like a good idea then. I'm

Re: [BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-13 Thread Magnus Hagander
2009/10/13 Tom Lane t...@sss.pgh.pa.us: Heikki Linnakangas heikki.linnakan...@enterprisedb.com writes: Magnus Hagander wrote: Actually, I found a note that said it's recommended to never increase it about 65535 - so perhaps we should put our limit at that instead od 32767? Yeah, setting it

[BUGS] Kerberos authentication, Active Directory, and PostgreSQL

2009-10-12 Thread Turner, Ian
Hello pgsql-bugs, While trying to connect our PostgreSQL database to our Kerberos realm, we encountered the obscure message Invalid message length. Tracking this down, we discovered that it was emitted by src/backend/libpq/pqcomm.c in response to a rather large Kerberos message. The root cause