Hello all,

tldr:

D:\>C:\OSGeo4W\bin\psql.exe service=the_db
psql: error: connection to server at "dbserver.example.lan
(192.168.4.104), port 5432 failed: could not initiate GSSAPI
security context: No credentials were supplied, or the credentials
were unavailable or inaccessible: Internal credentials cache error

Goal
====

I want to have my Postgresql clients (in this case psql.exe) on Windows
to authenticate against Active Directory.

Steps taken so far
==================

Linux client -> Active Directory -> Linux server works ------------------------------------------------------

I was able to get psql on Linux to authenticate against Active Directory
and with the service ticket that it got from Active Directory to
authenticate to the Postgresql service and server.

Windows client -> Active Directory does not work ------------------------------------------------

I do know that psql.exe (on Windows) is linked and is using GSS to do
Kerberos authentication.

A psql.exe that is not linked against GSS will tell me: "gssencmode
value "require" invalid when GSSAPI support is not compiled in"

A psql.exe that is linked against GSS will not tell me that. I'm
evidently now using the latter - a psql.exe that is linked against GSS.

So I know that the psql.exe that I'm using is linked against GSS.

Also, in the Windows shell I can issue a klist, and I see the Ticket
Granting Ticket and I see various service tickets (mainly to mount CIFS shares).

Also on Windows shell I can issue a

klist get postgres/dbserver.example.lan@EXAMPLE.LAN

and I see the ticket listed when I issue klist.

So I know that getting the service ticket on the Windows client does

indeed work.

When using psql.exe without setting `gssencmode = require` I am able to authenticate with username/password and connect to the Postgresql
service on the DB server just fine.

So I know that there is no problem with psql.exe wrt to connecting to

the Postgresql server and there is no problem with authentication per se.

I tried to trace psql.exe with the "Process Monitor" tool. I see that
(for whatever reason), psql.exe will open a TCP connection to the
Postgresql server. But it will *NOT* open a connection to the Active
Directory server.

Maybe it *shoud* connect to a local (that is on the local host) authentication/active directory service, but I do not know enough
Windows to know how I would see that in the "Process Monitor" trace.

I can see that psql.exe is accessing the Windows Registry and that it's accessing various DLLs, among others the kerberos library, and various
config files, such as the krb5.conf file, but I can not see it accessing
a keytab.

Again I do not know *exactly* how Active Directory/Kerberos access works
on Windows, but I *suspect* that the protocol on a Windows client is
*not* using keytab file.

I do see that `psql.exe` is trying to access a `ccapiserver.exe` file,
that is not there.

Question: is a `ccapiserver.exe` executable required in order to be able
to access tickets from a Kerberos client on a Windows client?

Other question: is the error "Internal credentials cache error" the root
cause of psql.exe not being able to authenticate against Active
Directory (I am supposing that the error "Internal credentials cache
error" refers to the kerberos client not being able to access the
*existing* tickets. But in "theory" psql.exe could try getting a ticket *without* accessing the existing tickets? So it wouldn't have to
forcibly fail there?).

And another question: is there any way to make GSS more talkative? At
this moment all that I can get as logs is the above "computer says no".
I was able to set the kerberos log to a local file, but that just tells
me that the client now wants to do authentication and that's that.

So that's as far as I got and I'm a bit at the end of my wisdom and a
would very, very much appreciate:

* help on how to proceed from here
* pointers to how configure krb5.conf-wise a given Windows executable
that links against GSS so that it can authenticate against active directory
* any help and pointer or debugging help
* has anybody been able to authenticate from Windows against Active
Directory and how did you do that respectively how did you set it up?

Any help would be very, very much appreciated, thank you.
*t

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)