LDAP, single sign on from Windows client

Greetings,

* chlor (hans.schou@gmail.com) wrote:

I have a Linux server which is setup with authentication via LDAP against a
Windows A/D. In pg_hba I have
host ... ldap ldapserver=example.org ldapprefix="" ldapsuffix="@example.org"

The user is also created in PostgreSQL but without a password.
I can then login with psql from a Windows client with a user defined in the
AD.

But the problem is that psql asks for a password.
Is it possible to make a single sign-on without the password prompt?

Yes, use GSSAPI based authentication instead of LDAP. Using GSSAPI is
also more secure and avoids sending the user's password to the PG
server.

PG Docs: https://www.postgresql.org/docs/current/gssapi-auth.html

Blog I wrote about setting it up:

https://blog.crunchydata.com/blog/windows-active-directory-postgresql-gssapi-kerberos-authentication

Thanks,

Stephen