postgresql

History

Peter Eisentraut 35c0754fad Allow ldaps when using ldap authentication While ldaptls=1 provides an RFC 4513 conforming way to do LDAP authentication with TLS encryption, there was an earlier de facto standard way to do LDAP over SSL called LDAPS. Even though it's not enshrined in a standard, it's still widely used and sometimes required by organizations' network policies. There seems to be no reason not to support it when available in the client library. Therefore, add support when using OpenLDAP 2.4+ or Windows. It can be configured with ldapscheme=ldaps or ldapurl=ldaps://... Add tests for both ways of requesting LDAPS and a test for the pre-existing ldaptls=1. Modify the 001_auth.pl test for "diagnostic messages", which was previously relying on the server rejecting ldaptls=1. Author: Thomas Munro Reviewed-By: Peter Eisentraut Discussion: https://postgr.es/m/CAEepm=1s+pA-LZUjQ-9GQz0Z4rX_eK=DFXAF1nBQ+ROPimuOYQ@mail.gmail.com		2018-01-03 10:11:26 -05:00
..
Makefile	Support SCRAM-SHA-256 authentication (RFC 5802 and 7677).	2017-03-07 14:25:40 +02:00
README.SSL	Remove useless whitespace at end of lines	2010-11-23 22:34:55 +02:00
auth-scram.c	Update copyright for 2018	2018-01-02 23:30:12 -05:00
auth.c	Allow ldaps when using ldap authentication	2018-01-03 10:11:26 -05:00
be-fsstubs.c	Update copyright for 2018	2018-01-02 23:30:12 -05:00
be-secure-openssl.c	Update copyright for 2018	2018-01-02 23:30:12 -05:00
be-secure.c	Update copyright for 2018	2018-01-02 23:30:12 -05:00
crypt.c	Update copyright for 2018	2018-01-02 23:30:12 -05:00
hba.c	Allow ldaps when using ldap authentication	2018-01-03 10:11:26 -05:00
ifaddr.c	Update copyright for 2018	2018-01-02 23:30:12 -05:00
pg_hba.conf.sample	Rename "scram" to "scram-sha-256" in pg_hba.conf and password_encryption.	2017-04-18 14:50:50 +03:00
pg_ident.conf.sample	Reformat the comments in pg_hba.conf and pg_ident.conf	2010-01-26 06:58:39 +00:00
pqcomm.c	Update copyright for 2018	2018-01-02 23:30:12 -05:00
pqformat.c	Update copyright for 2018	2018-01-02 23:30:12 -05:00
pqmq.c	Update copyright for 2018	2018-01-02 23:30:12 -05:00
pqsignal.c	Update copyright for 2018	2018-01-02 23:30:12 -05:00

README.SSL

src/backend/libpq/README.SSL

SSL
===

>From the servers perspective:


  Receives StartupPacket
           |
           |
 (Is SSL_NEGOTIATE_CODE?) -----------  Normal startup
           |                  No
           |
           | Yes
           |
           |
 (Server compiled with USE_SSL?) ------- Send 'N'
           |                       No        |
           |                                 |
           | Yes                         Normal startup
           |
           |
        Send 'S'
           |
           |
      Establish SSL
           |
           |
      Normal startup





>From the clients perspective (v6.6 client _with_ SSL):


      Connect
         |
         |
  Send packet with SSL_NEGOTIATE_CODE
         |
         |
  Receive single char  ------- 'S' -------- Establish SSL
         |                                       |
         | '<else>'                              |
         |                                  Normal startup
         |
         |
   Is it 'E' for error  ------------------- Retry connection
         |                  Yes             without SSL
         | No
         |
   Is it 'N' for normal ------------------- Normal startup
         |                  Yes
         |
   Fail with unknown

---------------------------------------------------------------------------