diff options
| author | Stephen Frost <sfrost@snowman.net> | 2023-04-13 08:55:13 -0400 |
|---|---|---|
| committer | Stephen Frost <sfrost@snowman.net> | 2023-04-13 08:55:13 -0400 |
| commit | f7431bca8b0138bdbce7025871560d39119565a0 (patch) | |
| tree | 977a68bd13725af6a34cf2fec653f91531149cf0 /src | |
| parent | 6633cfb21691840c33816a6dacaca0b504efb895 (diff) | |
| download | postgresql-f7431bca8b0138bdbce7025871560d39119565a0.tar.gz postgresql-f7431bca8b0138bdbce7025871560d39119565a0.zip | |
Explicitly require MIT Kerberos for GSSAPI
WHen building with GSSAPI support, explicitly require MIT Kerberos and
check for gssapi_ext.h in configure.ac and meson.build. Also add
documentation explicitly stating that we now require MIT Kerberos when
building with GSSAPI support.
Reveiwed by: Johnathan Katz
Discussion: https://postgr.es/m/abcc73d0-acf7-6896-e0dc-f5bc12a61bb1@postgresql.org
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/libpq/auth.c | 5 | ||||
| -rw-r--r-- | src/backend/libpq/be-secure-gssapi.c | 5 |
2 files changed, 6 insertions, 4 deletions
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index 00ec9da284b..a1a826e37fd 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -922,8 +922,9 @@ pg_GSS_recvauth(Port *port) gss_cred_id_t delegated_creds; /* - * Use the configured keytab, if there is one. Unfortunately, Heimdal - * doesn't support the cred store extensions, so use the env var. + * Use the configured keytab, if there is one. As we now require MIT + * Kerberos, we might consider using the credential store extensions in + * the future instead of the environment variable. */ if (pg_krb_server_keyfile != NULL && pg_krb_server_keyfile[0] != '\0') { diff --git a/src/backend/libpq/be-secure-gssapi.c b/src/backend/libpq/be-secure-gssapi.c index 73f8ce85549..6212f225fda 100644 --- a/src/backend/libpq/be-secure-gssapi.c +++ b/src/backend/libpq/be-secure-gssapi.c @@ -526,8 +526,9 @@ secure_open_gssapi(Port *port) PqGSSRecvLength = PqGSSResultLength = PqGSSResultNext = 0; /* - * Use the configured keytab, if there is one. Unfortunately, Heimdal - * doesn't support the cred store extensions, so use the env var. + * Use the configured keytab, if there is one. As we now require MIT + * Kerberos, we might consider using the credential store extensions in the + * future instead of the environment variable. */ if (pg_krb_server_keyfile != NULL && pg_krb_server_keyfile[0] != '\0') { |