Re: [HACKERS] GSSAPI and V2 protocol

2008-02-08 Thread Tom Lane
Magnus Hagander <[EMAIL PROTECTED]> writes: > On Thu, Feb 07, 2008 at 06:58:25PM -0500, Tom Lane wrote: >> This problem applies to SSPI too, correct? > Yeah, they work the same way. OK, I've fixed the server side to complain before any unparsable data is sent or received. But this happens after

Re: [HACKERS] GSSAPI and V2 protocol

2008-02-08 Thread Magnus Hagander
On Thu, Feb 07, 2008 at 06:58:25PM -0500, Tom Lane wrote: > Magnus Hagander <[EMAIL PROTECTED]> writes: > > Tom Lane wrote: > >> I vote we just decide that GSS isn't going to be supported on protocol > >> V2, and put a suitable error message into the server for that. It > >> doesn't seem to me tha

Re: [HACKERS] GSSAPI and V2 protocol

2008-02-07 Thread Tom Lane
Magnus Hagander <[EMAIL PROTECTED]> writes: > Tom Lane wrote: >> I vote we just decide that GSS isn't going to be supported on protocol >> V2, and put a suitable error message into the server for that. It >> doesn't seem to me that this combination is worth the amount of >> contortions it would re

Re: [HACKERS] GSSAPI and V2 protocol

2008-02-06 Thread Magnus Hagander
Tom Lane wrote: Magnus Hagander <[EMAIL PROTECTED]> writes: On Wed, Feb 06, 2008 at 02:57:39AM -0500, Kris Jurka wrote: On Tue, 5 Feb 2008, Tom Lane wrote: 2. We could retroactively redefine the contents of AuthenticationGSSContinue as carrying a length word after the authentication type code,

Re: [HACKERS] GSSAPI and V2 protocol

2008-02-06 Thread Tom Lane
Magnus Hagander <[EMAIL PROTECTED]> writes: > On Wed, Feb 06, 2008 at 02:57:39AM -0500, Kris Jurka wrote: >> On Tue, 5 Feb 2008, Tom Lane wrote: >>> 2. We could retroactively redefine the contents of >>> AuthenticationGSSContinue as carrying a length word after the >>> authentication type code, but

Re: [HACKERS] GSSAPI and V2 protocol

2008-02-06 Thread Magnus Hagander
On Wed, Feb 06, 2008 at 02:57:39AM -0500, Kris Jurka wrote: > > > On Tue, 5 Feb 2008, Tom Lane wrote: > > >The problem seems to be that AuthenticationGSSContinue messages carry > >a variable-length payload, and the V2 protocol doesn't really cope with > >that because it doesn't have a message le

Re: [HACKERS] GSSAPI and V2 protocol

2008-02-06 Thread Kris Jurka
On Tue, 5 Feb 2008, Tom Lane wrote: The problem seems to be that AuthenticationGSSContinue messages carry a variable-length payload, and the V2 protocol doesn't really cope with that because it doesn't have a message length word. 1. If the GSSContinue payload is self-identifying about its len

Re: [HACKERS] GSSAPI and V2 protocol

2008-02-05 Thread Tom Lane
I wrote: > The answer is "no, it doesn't work": > $ psql -l > psql: GSSAPI continuation error: Invalid token was supplied > GSSAPI continuation error: No error > $ > This surprises me; I would have thought the protocol was fairly > orthogonal to the auth method. We should look into it and see >

Re: [HACKERS] GSSAPI and V2 protocol

2008-02-05 Thread Tom Lane
Magnus Hagander <[EMAIL PROTECTED]> writes: > On Tue, Jan 29, 2008 at 03:34:19AM -0500, Kris Jurka wrote: >> Is it possible to authenticate using GSSAPI over the V2 protocol? Is >> there any documentation on the message formats for V2? > Honestly - don't know :-) Never looked at that part. I tr

Re: [HACKERS] GSSAPI and V2 protocol

2008-02-05 Thread Magnus Hagander
Kris Jurka wrote: On Tue, 5 Feb 2008, Magnus Hagander wrote: Does this mean you have GSSAPI auth working for protocol v3? :-) Yes, but since I'm not terribly familiar with GSSAPI or JAAS, I'm not sure what configuration options need to get exposed to the user. http://archives.postgresql

Re: [HACKERS] GSSAPI and V2 protocol

2008-02-05 Thread Kris Jurka
On Tue, 5 Feb 2008, Magnus Hagander wrote: Does this mean you have GSSAPI auth working for protocol v3? :-) Yes, but since I'm not terribly familiar with GSSAPI or JAAS, I'm not sure what configuration options need to get exposed to the user. http://archives.postgresql.org/pgsql-jdbc/200

Re: [HACKERS] GSSAPI and V2 protocol

2008-02-05 Thread Magnus Hagander
Kris Jurka wrote: On Tue, 5 Feb 2008, Magnus Hagander wrote: On Tue, Jan 29, 2008 at 03:34:19AM -0500, Kris Jurka wrote: Is it possible to authenticate using GSSAPI over the V2 protocol? Is there any documentation on the message formats for V2? Honestly - don't know :-) Never looked at t

Re: [HACKERS] GSSAPI and V2 protocol

2008-02-05 Thread Kris Jurka
On Tue, 5 Feb 2008, Magnus Hagander wrote: On Tue, Jan 29, 2008 at 03:34:19AM -0500, Kris Jurka wrote: Is it possible to authenticate using GSSAPI over the V2 protocol? Is there any documentation on the message formats for V2? Honestly - don't know :-) Never looked at that part. I mean, t

Re: [HACKERS] GSSAPI and V2 protocol

2008-02-05 Thread Magnus Hagander
On Tue, Jan 29, 2008 at 03:34:19AM -0500, Kris Jurka wrote: > > Is it possible to authenticate using GSSAPI over the V2 protocol? Is > there any documentation on the message formats for V2? Honestly - don't know :-) Never looked at that part. I mean, the V2 protocol is *really* old by now, isn'

[HACKERS] GSSAPI and V2 protocol

2008-01-29 Thread Kris Jurka
Is it possible to authenticate using GSSAPI over the V2 protocol? Is there any documentation on the message formats for V2? Kris Jurka ---(end of broadcast)--- TIP 3: Have you checked our extensive FAQ? http://www.postgresql.org/