Thread

1. pg_hba y ldap

   Diego <mrstephenamell@gmail.com> — 2019-10-21T17:06:55Z

   Hola lista, ¿como va?
   
   Consulta de ldap en el pg_hba, si listan x ip mas de un servidor... 
   cuando el primero muere... deberia saltar al segundo?
   
   host    all             all             0.0.0.0/0 ldap 
   ldapserver="10.20.90.251 10.20.90.252 10.10.90.251 10.10.90.252" 
   ldapport=389...
   
   
   pg11 y ldap ipa server
   
   
   

2. pg_hba & ldap

   Diego <mrstephenamell@gmail.com> — 2019-10-22T12:11:59Z

   Hi all!
   
   I have a problem with ldap authentication, I have a ldap string like this:
   
   host all             all             0.0.0.0/0 ldap 
   ldapserver="10.20.90.251 10.20.90.252 10.10.90.251 10.10.90.252" 
   ldapport=389...
   
   It is correct? if the firs server is down, pg will go to the next one to 
   continue authenticating?
   
   It's a pg11 and ldap is an ipa server
   
   thanks a lot,
   
   Diego
   
   

3. Re: pg_hba & ldap

   Stephen Frost <sfrost@snowman.net> — 2019-10-22T12:43:34Z

   Greetings,
   
   * Diego (mrstephenamell@gmail.com) wrote:
   > I have a problem with ldap authentication, I have a ldap string like this:
   > 
   > host all             all             0.0.0.0/0 ldap ldapserver="10.20.90.251
   > 10.20.90.252 10.10.90.251 10.10.90.252" ldapport=389...
   > 
   > It is correct? if the firs server is down, pg will go to the next one to
   > continue authenticating?
   
   Yes, that looks like it should work- is it not?
   
   > It's a pg11 and ldap is an ipa server
   
   Note that with an IPA setup, similar to if you were running Active
   Directory, you have Kerberos and a KDC available, which is a much better
   authentication mechanism that removes the need for the database sever to
   reach out to another system to handle the authentication, and avoids
   having the user's password sent to the database server.  You might want
   to consider using that (which is called 'gssapi' in PostgreSQL, which is
   basically generalized Kerberos) instead of LDAP.
   
   Thanks,
   
   Stephen
   

4. Re: pg_hba y ldap

   Carlos T. Groero Carmona <ctonetg@gmail.com> — 2019-11-07T19:45:00Z

   Hola Diego,
   
   Porque usas varias IP en vez de una url.
   Imagino que estas usando un proveedor interno, que no usas uno externo como
   jumpCloud por ejemplo.
   
   Saludos,
   
   On Mon, Oct 21, 2019 at 12:07 PM Diego <mrstephenamell@gmail.com> wrote:
   
   > Hola lista, ¿como va?
   >
   > Consulta de ldap en el pg_hba, si listan x ip mas de un servidor... cuando
   > el primero muere... deberia saltar al segundo?
   >
   > host    all             all             0.0.0.0/0 ldap
   > ldapserver="10.20.90.251 10.20.90.252 10.10.90.251 10.10.90.252"
   > ldapport=389...
   >
   >
   > pg11 y ldap ipa server
   >
   >
   >