diff --git a/doc/src/sgml/release-8.4.sgml b/doc/src/sgml/release-8.4.sgml index c7c22fe856..a567afffb7 100644 --- a/doc/src/sgml/release-8.4.sgml +++ b/doc/src/sgml/release-8.4.sgml @@ -1,4 +1,4 @@ - + @@ -2703,12 +2703,18 @@ - Make Kerberos connections use the same method to determine the - username of the client as all other authentication methods (Magnus) + Do not rely on Kerberos tickets to determine the default database + username (Magnus) - Previously a special Kerberos-only API was used. + Previously, a Kerberos-capable build of libpq would use the + principal name from any available Kerberos ticket as default + database username, even if the connection wasn't using Kerberos + authentication. This was deemed inconsistent and confusing. + The default username is now determined the same way with or + without Kerberos. Note however that the database username must still + match the ticket when Kerberos authentication is used.