Horton

Re: longfin missing gssapi_ext.h

Tom Lane <tgl@sss.pgh.pa.us>

View thread View on postgr.es
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Thomas Munro <thomas.munro@gmail.com>, pgsql-hackers@lists.postgresql.org
Date: 2023-04-10T15:16:47Z
Lists: pgsql-hackers 
Stephen Frost <sfrost@snowman.net> writes:
> Yeah, I wouldn't be the least bit surprised if many folks running
> FreeBSD with any interest in Kerberos have MIT Kerberos installed given
> that Heimdal doesn't seem to be under any kind of ongoing active
> development and is just in this maintenance mode.

Yeah, that's a pretty scary situation for security-critical software.
Maybe we should just desupport Heimdal, rather than investing effort
to the contrary?

Also, the core-code versions of Heimdal in these BSDen are even scarier
than the upstream releases, so I'm thinking that the fact that we
currently compile against them is more a net negative than a positive.
(Same logic as for macOS, really.)

IOW, maybe it'd be okay to de-revert 3d4fa227b and add documentation
saying that --with-gssapi requires MIT Kerberos not Heimdal.

			regards, tom lane

Commits

  1. Further cleanup of autoconf output files for GSSAPI changes.

  2. Update Kerberos/GSSAPI configure/meson check

  3. Explicitly require MIT Kerberos for GSSAPI

  4. De-Revert "Add support for Kerberos credential delegation"

  5. Revert "Add support for Kerberos credential delegation"