Re: [Qgis-user] QGIS for Windows with GSS/Kerberos/Active Directory

[Tomas Pospisek via QGIS-User]

On 06.02.23 09:53, Tomas Pospisek via QGIS-User wrote:


On 04.02.23 16:56, Jürgen E. Fischer via QGIS-User wrote:

On Fri, 03. Feb 2023 at 16:41:28 +0100, Tomas Pospisek via QGIS-User 
wrote:
So it seems QGIS as shipped by qgis.org does not ship with GSS 
support? Is

that correct?


Yes.


Does anybody use QGIS on Windows with GSS?


Apparently not.



Any pointers/suggestions/help?
Please try libpq 15.1-1 from OSGeo4W (choose "Advanced Install" and 
enable

Exp.)


Thanks a lot! I will!


OK, so I was finally able to set up:

* Postgresql with Kerberos on Linux
* psql/QGIS with SSPI on Windows

and thus to authenticate from QGIS via Active Directory to the 
Postgresql server.


The details can be found 
[here](https://www.postgresql.org/message-id/08b836a7-272a-2309-da45-ac691fccacb8%40sourcepole.ch).


I short:

* don't use GSS on the Windows side
* only set the DB name and the DB derver (not the password,
  not the user, no authentication method or anything) and
  QGIS/psql/libpq will by default and out of the box use the SSPI
  interface that will use Active Directory that will use the Kerberos
  protocol and everything will work magically by itself, without any
  further intervention. This is only the client side. The server side
  (that is the postgresql server), still needs to be set up to do
  Kerberos via GSS).

Shout outs go to Stephen Frost and Jürgen E. Fischer for helping and 
caring. Many, many, many thanks for that!!!


And least but not least. It seems like libpq from the "Advanced 
Installer" from OSGeo4W can *not* do SSPI. It's always trying to use GSS 
and failing to do so. I'm not 100% clear on that since I was not able to 
test further, since I do not have direct access to the systems in 
question, however for anybody getting stuck in the same mud as me or 
those that build the "Advanced Installer" that's certainly something to 
be aware of.


Thanks & greetings,
*t
___
QGIS-User mailing list
QGIS-User@lists.osgeo.org
List info: https://lists.osgeo.org/mailman/listinfo/qgis-user
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-user

Re: [Qgis-user] QGIS for Windows with GSS/Kerberos/Active Directory

[Tomas Pospisek via QGIS-User]

Hi  Jürgen

On 04.02.23 16:56, Jürgen E. Fischer via QGIS-User wrote:


On Fri, 03. Feb 2023 at 16:41:28 +0100, Tomas Pospisek via QGIS-User wrote:

So it seems QGIS as shipped by qgis.org does not ship with GSS support? Is
that correct?


Yes.


Does anybody use QGIS on Windows with GSS?


Apparently not.



Any pointers/suggestions/help?
  
Please try libpq 15.1-1 from OSGeo4W (choose "Advanced Install" and enable

Exp.)


Thanks a lot! I will!
*t

___
QGIS-User mailing list
QGIS-User@lists.osgeo.org
List info: https://lists.osgeo.org/mailman/listinfo/qgis-user
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-user

Re: [Qgis-user] QGIS for Windows with GSS/Kerberos/Active Directory

[Jürgen E . Fischer via QGIS-User]

Hi Tomas,

On Fri, 03. Feb 2023 at 16:41:28 +0100, Tomas Pospisek via QGIS-User wrote:
> So it seems QGIS as shipped by qgis.org does not ship with GSS support? Is
> that correct?

Yes.

> Does anybody use QGIS on Windows with GSS?

Apparently not.


> Any pointers/suggestions/help?
 
Please try libpq 15.1-1 from OSGeo4W (choose "Advanced Install" and enable
Exp.)


Jürgen

-- 
Jürgen E. Fischer   norBIT GmbH Tel. +49-4931-918175-31
Dipl.-Inf. (FH) Rheinstraße 13  Fax. +49-4931-918175-50
Software Engineer   D-26506 Nordenhttps://www.norbit.de
QGIS release manager (PSC)  Germany IRC: jef on Libera|OFTC


signature.asc
Description: PGP signature
___
QGIS-User mailing list
QGIS-User@lists.osgeo.org
List info: https://lists.osgeo.org/mailman/listinfo/qgis-user
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-user

Re: [Qgis-user] QGIS for Windows with GSS/Kerberos/Active Directory

[Tomas Pospisek via QGIS-User]

On 03.02.23 20:06, chris hermansen wrote:

On Fri, Feb 3, 2023 at 9:25 AM Tomas Pospisek via QGIS-User 
mailto:qgis-user@lists.osgeo.org>> wrote:


On 03.02.23 18:02, chris hermansen wrote:

>  >

 > On Fri, Feb 3, 2023 at 8:11 AM Tomas Pospisek via QGIS-User
 > mailto:qgis-user@lists.osgeo.org>
>> wrote:
 >
 >     When I try to set up a connection to a Postgres/Postgis DB server 
with
 >     Active Directory/Kerberos/GSS authentication the QGIS DB setup dialog
 >     displays this message:
 >
 >           gssencmode value "require" invalid when GSSAPI support is not 
compiled in
 >
 >     When I check the Postgres source code [1] I see that apparently this
 >     gets displayed when GSS support is not compiled in.
 >
 >     So it seems QGIS as shipped by qgis.org does not ship with GSS 
support?
 >     Is that correct?
 >
 >     Does anybody use QGIS on Windows with GSS? How did you do it?
 >
 >     I could go ahead and download the EDB Postgres ZIP [3] and exctract
 >     libpq.dll from it and replace the libqq.dll shipped by the QGIS
 >     installer with it, but I'm not sure if that would work at all, if 
that
 >     would be robust and it'll certainly be a pain to maintain.
 >
 >     Any pointers/suggestions/help?
 >
 >
 > Maybe this is the proverbial dumb question... but why not install your
 > EDB PostgreSQL on your windows machine and run it on a different port?
 > And then connect to it from your QGIS instance, on that different port
 > of course?

Thanks for your answer Chris, but I can't see how you your reply relates
to my question. I need QGIS to authenticate users with Active
Directory/Kerberos. That QGIS/libpq fails to do so doesn't have anything
to do with ports but with the fact that GSS support is not compiled into
the libpq that is furnished with QGIS.


Sorry I was somehow thinking that by using a different PostgreSQL 
installation "in its entirety" you could avoid using the libqq.dll (or 
is it libpq.dll) that QGIS installs.


Yeah, that's kinda what I have in mind, however I fear DLL hell and I am 
not knowledgeable how to do it "right". So that's why I am asking for 
advice from people who might have travelled this path before...


My apologies for contributing nothing useful to the solution of your 
problem.


Ah, I'm sorry for making it sound like that :-(. I'm very glad you tried 
to help...! Thank you :-)!

*t

___
QGIS-User mailing list
QGIS-User@lists.osgeo.org
List info: https://lists.osgeo.org/mailman/listinfo/qgis-user
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-user

Re: [Qgis-user] QGIS for Windows with GSS/Kerberos/Active Directory

[chris hermansen via QGIS-User]

Tomas and list,

On Fri, Feb 3, 2023 at 9:25 AM Tomas Pospisek via QGIS-User <
qgis-user@lists.osgeo.org> wrote:

> On 03.02.23 18:02, chris hermansen wrote:
> > Tomas and list,
> >
> > On Fri, Feb 3, 2023 at 8:11 AM Tomas Pospisek via QGIS-User
> > mailto:qgis-user@lists.osgeo.org>> wrote:
> >
> > When I try to set up a connection to a Postgres/Postgis DB server
> with
> > Active Directory/Kerberos/GSS authentication the QGIS DB setup dialog
> > displays this message:
> >
> >   gssencmode value "require" invalid when GSSAPI support is not
> > compiled in
> >
> > When I check the Postgres source code [1] I see that apparently this
> > gets displayed when GSS support is not compiled in.
> >
> > So it seems QGIS as shipped by qgis.org  does not
> > ship with GSS support?
> > Is that correct?
> >
> > Does anybody use QGIS on Windows with GSS? How did you do it?
> >
> > I could go ahead and download the EDB Postgres ZIP [3] and exctract
> > libpq.dll from it and replace the libqq.dll shipped by the QGIS
> > installer with it, but I'm not sure if that would work at all, if
> that
> > would be robust and it'll certainly be a pain to maintain.
> >
> > Any pointers/suggestions/help?
> >
> >
> > Maybe this is the proverbial dumb question... but why not install your
> > EDB PostgreSQL on your windows machine and run it on a different port?
> > And then connect to it from your QGIS instance, on that different port
> > of course?
>
> Thanks for your answer Chris, but I can't see how you your reply relates
> to my question. I need QGIS to authenticate users with Active
> Directory/Kerberos. That QGIS/libpq fails to do so doesn't have anything
> to do with ports but with the fact that GSS support is not compiled into
> the libpq that is furnished with QGIS.
>
>
Sorry I was somehow thinking that by using a different PostgreSQL
installation "in its entirety" you could avoid using the libqq.dll (or is
it libpq.dll) that QGIS installs.  I guess I'm too used to (spoiled by?)
apt based installations on Linux where applications tend to use what's in
the distro's repositories for this kind of stuff.

My apologies for contributing nothing useful to the solution of your
problem.


-- 
Chris Hermansen · clhermansen "at" gmail "dot" com

C'est ma façon de parler.
___
QGIS-User mailing list
QGIS-User@lists.osgeo.org
List info: https://lists.osgeo.org/mailman/listinfo/qgis-user
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-user

Re: [Qgis-user] QGIS for Windows with GSS/Kerberos/Active Directory

[Tomas Pospisek via QGIS-User]

On 03.02.23 18:02, chris hermansen wrote:

Tomas and list,

On Fri, Feb 3, 2023 at 8:11 AM Tomas Pospisek via QGIS-User 
mailto:qgis-user@lists.osgeo.org>> wrote:


When I try to set up a connection to a Postgres/Postgis DB server with
Active Directory/Kerberos/GSS authentication the QGIS DB setup dialog
displays this message:

      gssencmode value "require" invalid when GSSAPI support is not
compiled in

When I check the Postgres source code [1] I see that apparently this
gets displayed when GSS support is not compiled in.

So it seems QGIS as shipped by qgis.org  does not
ship with GSS support?
Is that correct?

Does anybody use QGIS on Windows with GSS? How did you do it?

I could go ahead and download the EDB Postgres ZIP [3] and exctract
libpq.dll from it and replace the libqq.dll shipped by the QGIS
installer with it, but I'm not sure if that would work at all, if that
would be robust and it'll certainly be a pain to maintain.

Any pointers/suggestions/help?


Maybe this is the proverbial dumb question... but why not install your 
EDB PostgreSQL on your windows machine and run it on a different port?  
And then connect to it from your QGIS instance, on that different port 
of course?


Thanks for your answer Chris, but I can't see how you your reply relates 
to my question. I need QGIS to authenticate users with Active 
Directory/Kerberos. That QGIS/libpq fails to do so doesn't have anything 
to do with ports but with the fact that GSS support is not compiled into 
the libpq that is furnished with QGIS.

*t

___
QGIS-User mailing list
QGIS-User@lists.osgeo.org
List info: https://lists.osgeo.org/mailman/listinfo/qgis-user
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-user

Re: [Qgis-user] QGIS for Windows with GSS/Kerberos/Active Directory

[chris hermansen via QGIS-User]

Tomas and list,

On Fri, Feb 3, 2023 at 8:11 AM Tomas Pospisek via QGIS-User <
qgis-user@lists.osgeo.org> wrote:

> When I try to set up a connection to a Postgres/Postgis DB server with
> Active Directory/Kerberos/GSS authentication the QGIS DB setup dialog
> displays this message:
>
>  gssencmode value "require" invalid when GSSAPI support is not
> compiled in
>
> When I check the Postgres source code [1] I see that apparently this
> gets displayed when GSS support is not compiled in.
>
> So it seems QGIS as shipped by qgis.org does not ship with GSS support?
> Is that correct?
>
> Does anybody use QGIS on Windows with GSS? How did you do it?
>
> I could go ahead and download the EDB Postgres ZIP [3] and exctract
> libpq.dll from it and replace the libqq.dll shipped by the QGIS
> installer with it, but I'm not sure if that would work at all, if that
> would be robust and it'll certainly be a pain to maintain.
>
> Any pointers/suggestions/help?
>

Maybe this is the proverbial dumb question... but why not install your EDB
PostgreSQL on your windows machine and run it on a different port?  And
then connect to it from your QGIS instance, on that different port of
course?


-- 
Chris Hermansen · clhermansen "at" gmail "dot" com

C'est ma façon de parler.
___
QGIS-User mailing list
QGIS-User@lists.osgeo.org
List info: https://lists.osgeo.org/mailman/listinfo/qgis-user
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-user

[Qgis-user] QGIS for Windows with GSS/Kerberos/Active Directory

[Tomas Pospisek via QGIS-User]

When I try to set up a connection to a Postgres/Postgis DB server with 
Active Directory/Kerberos/GSS authentication the QGIS DB setup dialog 
displays this message:


gssencmode value "require" invalid when GSSAPI support is not 
compiled in


When I check the Postgres source code [1] I see that apparently this 
gets displayed when GSS support is not compiled in.


So it seems QGIS as shipped by qgis.org does not ship with GSS support? 
Is that correct?


Does anybody use QGIS on Windows with GSS? How did you do it?

I could go ahead and download the EDB Postgres ZIP [3] and exctract 
libpq.dll from it and replace the libqq.dll shipped by the QGIS 
installer with it, but I'm not sure if that would work at all, if that 
would be robust and it'll certainly be a pain to maintain.


Any pointers/suggestions/help?
*t

[1] https://doxygen.postgresql.org/fe-connect_8c_source.html#l01357
[2] https://qgis.org/de/site/forusers/download.html#windows
[3] https://www.enterprisedb.com/downloads/postgres-postgresql-downloads
___
QGIS-User mailing list
QGIS-User@lists.osgeo.org
List info: https://lists.osgeo.org/mailman/listinfo/qgis-user
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-user