I'm trying to get authentication working using kerberos in Windows instead of username and password when connecting to PostgreSQL. Very new to this area and would appreciate any thoughts. In essence what I want to achieve is not having the password in the app configuration. Maybe there are other options apart from using kerberos?
Will the following work?
configure Postgres for SSPI authentication
create a user in Postgres with the same user name as the SPN of the user in the AD
pre-create kerberos authentication tickets (somehow magically) for the created user
connect to postgres using psql with the above user without providing the password
If this is at all possible I'm interested in how to achieve that magical part above ^^^
Thanks.
I deployed a aurora cluster for postgresql engine and enabled IAM authentication (Password and IAM database authentication). I created a user with below commands:
CREATE USER test WITH PASSWORD '123456';
GRANT rds_iam TO test;
I am able to login the database with aws rds generate-db-auth-token auto generated token but I can't login with the native password.
The command I am using to login is:
psql "host=dev-ams-engine-aurora-auroracluster.cluster-xxxxx.ap-southeast-2.rds.amazonaws.com dbname=Test user=test"
The error I got when login with native password is:
psql: error: could not connect to server: FATAL: PAM authentication failed for user "test"
Based on AWS doc:
Password and IAM database authentication
Manage your database user credentials through your DB engine's native password authentication
features and IAM users and roles. IAM helps an administrator securely control access to AWS
resources. IAM administrators control who can be authenticated and authorized for RDS resources.
It seems that it should support both IAM user/role and native password. Why can't I use native password to login?
I am trying to make an admin user, which can authenticate to any database. When I do something like this:
db.createUser({
"user": "admin",
"pwd": "adminPassword",
"roles": [
"userAdminAnyDatabase",
"dbAdminAnyDatabase",
"readWriteAnyDatabase"
]
});
It works fine when connecting to the admin database. However, it doesn't work when I try something like this: mongodb://admin:adminPassword#localhost:27017/someDatabaseHere. I cannot authenticate to someDatabaseHere unless I authenticate to the admin database first, then go change stuff around in someDatabaseHere afterwards.
I really want to get the URI working as above, without needing to create an user for each database afterwards.
Alternatively, I would like to authenticate locally without credentials (simply mongodb://localhost:27017/someDatabaseHere) but require credentials remotely. That could work as well.
unless I authenticate to the admin database first, then go change stuff around in someDatabaseHere afterwards.
Currently (as of MongoDB 3.4.10), this is how the authentication mechanism works. This is the purpose of the --authenticationDatabase parameter. If the user is defined in the admin database, then it should have access to all databases on the server, existing or not.
I would like to authenticate locally without credentials
Currently this is not possible, since MongoDB uses a role-based authentication scheme and not IP-based authentication.
Any way to get Proxy User authentication done in PostgreSql?
As from Oracles
https://oracle-base.com/articles/misc/proxy-users-and-connect-through#proxy-user-and-connect-through
So I am trying to setup authentication on MongoDB instance. This is the first time doing this. I currently have an instance running off of localhost with no authentication. I have created users with admin rights as well as two users with readwrite rights. I have tried to log in to the httpinterface using these users but it doesn't let me in. Also, I am trying to create a connection from another server to this database instance but it does not allow me to. If i login to the server through SSH and authenticate on the mongo shell it works fine and returns 1. Any thoughts or suggestions?
I get the following error from the Mongo Connection:
array(2) { ["ok"]=> int(0) ["errmsg"]=> string(130) "Failed to connect to: IP:PORT: Authentication failed on database 'DB' with username 'User': auth failed" }
This user was just created and has readWrite rights and I know the password is correct.