Unix Technical Forum

Krb5 & multiple DB connections

This is a discussion on Krb5 & multiple DB connections within the pgsql Hackers forums, part of the PostgreSQL category; --> Greetings, I've just run smack-dab into the bug described here: http://archives.postgresql.org/pgsql...5/msg00083.php and it's somewhat frustrating since the end of ...


Go Back   Unix Technical Forum > Database Server Software > PostgreSQL > pgsql Hackers

FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 04-11-2008, 07:53 AM
Stephen Frost
 
Posts: n/a
Default Krb5 & multiple DB connections

Greetings,

I've just run smack-dab into the bug described here:

http://archives.postgresql.org/pgsql...5/msg00083.php

and it's somewhat frustrating since the end of that thread is a
reasonably small patch which fixes the problem:

http://archives.postgresql.org/pgsql...5/msg00083.php

Or did for that user anyway but it sure looks like it's solve my
problem as well (which is also a case of using mod_auth_krb5, etc,
though it breaks even for the same user since apache now, correctly,
deletes and recreates the cache with a different filename for each
connection).

I realize it's not entirely fair (given that it was years ago) to ask
this, but, anyone happen to know why the patch wasn't accepted? It
almost patched cleanly against current HEAD even. I went ahead and
made the few changes by hand that didn't apply cleanly and it compiled
just fine; attached patch is against current HEAD and should apply
cleanly.

I'd really love to get this fixed.

Thanks (off to go implement Tom's suggestion for pg_restore !

Stephen


---------------------------(end of broadcast)---------------------------
TIP 5: don't forget to increase your free space map settings

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #2 (permalink)  
Old 04-11-2008, 07:53 AM
Stephen Frost
 
Posts: n/a
Default Re: Krb5 & multiple DB connections

* Stephen Frost (sfrost@snowman.net) wrote:
> and it's somewhat frustrating since the end of that thread is a
> reasonably small patch which fixes the problem:
>
> http://archives.postgresql.org/pgsql...5/msg00083.php


Erp, not quite sure how I managed that, the end of the thread is *here*:

http://archives.postgresql.org/pgsql...5/msg00090.php

Sorry about that.

Stephen

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFD4r4nrzgMPqB3kigRApWDAJ47D9whe1g1xmedqpEzR5 OYpSWOugCdHeHv
vNqr/xxv3hqOO/puRI3w04Y=
=d05O
-----END PGP SIGNATURE-----

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #3 (permalink)  
Old 04-11-2008, 07:53 AM
John
 
Posts: n/a
Default Where to execute the compiled psql

Greetings,

I am writing some plugin for pq. After running ./configure and make, shall I
just go to /src/bin/psql to execute my executable psql -U (usrname) dbname?
It seems that my updates in the file parse_expr.c is not reflect in this
executable? For example, I changed one line from

if (NULL == tup)
ereport(ERROR, (errcode(ERRCODE_UNDEFINED_OBJECT),
errmsg("key value not found")));

-->

if (NULL == tup)
ereport(ERROR, (errcode(ERRCODE_UNDEFINED_OBJECT),
errmsg("key value not found while building relation")));

But the program still reports key value not found when it runs.

Best wishes,
John

---------------------------(end of broadcast)---------------------------
TIP 2: Don't 'kill -9' the postmaster

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #4 (permalink)  
Old 04-11-2008, 07:53 AM
Peter Eisentraut
 
Posts: n/a
Default Re: Where to execute the compiled psql

John wrote:
> I am writing some plugin for pq. After running ./configure and make,
> shall I just go to /src/bin/psql to execute my executable psql -U
> (usrname) dbname? It seems that my updates in the file parse_expr.c
> is not reflect in this executable?


Evidently you're not (only) writing a plugin but changing the source
code. In that case, follow the normal installation instructions.

--
Peter Eisentraut
http://developer.postgresql.org/~petere/

---------------------------(end of broadcast)---------------------------
TIP 9: In versions below 8.0, the planner will ignore your desire to
choose an index scan if your joining column's datatypes do not
match

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #5 (permalink)  
Old 04-11-2008, 07:55 AM
Stephen Frost
 
Posts: n/a
Default Re: Krb5 & multiple DB connections

Greetings,

* Stephen Frost (sfrost@snowman.net) wrote:
> I realize it's not entirely fair (given that it was years ago) to ask
> this, but, anyone happen to know why the patch wasn't accepted? It
> almost patched cleanly against current HEAD even. I went ahead and
> made the few changes by hand that didn't apply cleanly and it compiled
> just fine; attached patch is against current HEAD and should apply
> cleanly.


I've now tested this patch at home w/ 8.2HEAD and it seems to fix the
bug. I plan on testing it under 8.1.2 at work tommorow with
mod_auth_krb5, etc, and expect it'll work there. Assuming all goes
well and unless someone objects I'll forward the patch to -patches.
It'd be great to have this fixed as it'll allow us to use Kerberos to
authenticate to phppgadmin and other web-based tools which use
Postgres.

Thanks!

Stephen

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFD5jt9rzgMPqB3kigRAhjsAJ45E7wPloLtqC1+uo4EaQ f/jtPV4gCfRbTn
8pZxjdGBQ8C+Sv7n2L/KV+k=
=jgBC
-----END PGP SIGNATURE-----

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #6 (permalink)  
Old 04-11-2008, 07:55 AM
Stephen Frost
 
Posts: n/a
Default Re: Krb5 & multiple DB connections

Greetings,

* Stephen Frost (sfrost@snowman.net) wrote:
> I've now tested this patch at home w/ 8.2HEAD and it seems to fix the
> bug. I plan on testing it under 8.1.2 at work tommorow with
> mod_auth_krb5, etc, and expect it'll work there. Assuming all goes
> well and unless someone objects I'll forward the patch to -patches.
> It'd be great to have this fixed as it'll allow us to use Kerberos to
> authenticate to phppgadmin and other web-based tools which use
> Postgres.


While playing with this patch under 8.1.2 at home I discovered a
mistake in how I manually applied one of the hunks to fe-auth.c.
Basically, the base code had changed and so the patch needed to be
modified slightly. This is because the code no longer either has a
freeable pointer under 'name' or has 'name' as NULL.

The attached patch correctly frees the string from pg_krb5_authname
(where it had been strdup'd) if and only if pg_krb5_authname returned
a string (as opposed to falling through and having name be set using
name = pw->name. Also added a comment to this effect.
Please review.

Thanks,

Stephen


---------------------------(end of broadcast)---------------------------
TIP 6: explain analyze is your friend

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #7 (permalink)  
Old 04-11-2008, 08:02 AM
Bruce Momjian
 
Posts: n/a
Default Re: Krb5 & multiple DB connections


Your patch has been added to the PostgreSQL unapplied patches list at:

http://momjian.postgresql.org/cgi-bin/pgpatches

It will be applied as soon as one of the PostgreSQL committers reviews
and approves it.

---------------------------------------------------------------------------


Stephen Frost wrote:
> Greetings,
>
> * Stephen Frost (sfrost@snowman.net) wrote:
> > I've now tested this patch at home w/ 8.2HEAD and it seems to fix the
> > bug. I plan on testing it under 8.1.2 at work tommorow with
> > mod_auth_krb5, etc, and expect it'll work there. Assuming all goes
> > well and unless someone objects I'll forward the patch to -patches.
> > It'd be great to have this fixed as it'll allow us to use Kerberos to
> > authenticate to phppgadmin and other web-based tools which use
> > Postgres.

>
> While playing with this patch under 8.1.2 at home I discovered a
> mistake in how I manually applied one of the hunks to fe-auth.c.
> Basically, the base code had changed and so the patch needed to be
> modified slightly. This is because the code no longer either has a
> freeable pointer under 'name' or has 'name' as NULL.
>
> The attached patch correctly frees the string from pg_krb5_authname
> (where it had been strdup'd) if and only if pg_krb5_authname returned
> a string (as opposed to falling through and having name be set using
> name = pw->name. Also added a comment to this effect.
> Please review.
>
> Thanks,
>
> Stephen


[ Attachment, skipping... ]

>
> ---------------------------(end of broadcast)---------------------------
> TIP 6: explain analyze is your friend


--
Bruce Momjian | http://candle.pha.pa.us
pgman@candle.pha.pa.us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073

---------------------------(end of broadcast)---------------------------
TIP 9: In versions below 8.0, the planner will ignore your desire to
choose an index scan if your joining column's datatypes do not
match

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #8 (permalink)  
Old 04-11-2008, 08:02 AM
Bruce Momjian
 
Posts: n/a
Default Re: Krb5 & multiple DB connections


Is this something we need for 8.1.X?

---------------------------------------------------------------------------

Bruce Momjian wrote:
>
> Your patch has been added to the PostgreSQL unapplied patches list at:
>
> http://momjian.postgresql.org/cgi-bin/pgpatches
>
> It will be applied as soon as one of the PostgreSQL committers reviews
> and approves it.
>
> ---------------------------------------------------------------------------
>
>
> Stephen Frost wrote:
> > Greetings,
> >
> > * Stephen Frost (sfrost@snowman.net) wrote:
> > > I've now tested this patch at home w/ 8.2HEAD and it seems to fix the
> > > bug. I plan on testing it under 8.1.2 at work tommorow with
> > > mod_auth_krb5, etc, and expect it'll work there. Assuming all goes
> > > well and unless someone objects I'll forward the patch to -patches.
> > > It'd be great to have this fixed as it'll allow us to use Kerberos to
> > > authenticate to phppgadmin and other web-based tools which use
> > > Postgres.

> >
> > While playing with this patch under 8.1.2 at home I discovered a
> > mistake in how I manually applied one of the hunks to fe-auth.c.
> > Basically, the base code had changed and so the patch needed to be
> > modified slightly. This is because the code no longer either has a
> > freeable pointer under 'name' or has 'name' as NULL.
> >
> > The attached patch correctly frees the string from pg_krb5_authname
> > (where it had been strdup'd) if and only if pg_krb5_authname returned
> > a string (as opposed to falling through and having name be set using
> > name = pw->name. Also added a comment to this effect.
> > Please review.
> >
> > Thanks,
> >
> > Stephen

>
> [ Attachment, skipping... ]
>
> >
> > ---------------------------(end of broadcast)---------------------------
> > TIP 6: explain analyze is your friend

>
> --
> Bruce Momjian | http://candle.pha.pa.us
> pgman@candle.pha.pa.us | (610) 359-1001
> + If your life is a hard drive, | 13 Roberts Road
> + Christ can be your backup. | Newtown Square, Pennsylvania 19073
>
> ---------------------------(end of broadcast)---------------------------
> TIP 9: In versions below 8.0, the planner will ignore your desire to
> choose an index scan if your joining column's datatypes do not
> match
>


--
Bruce Momjian | http://candle.pha.pa.us
pgman@candle.pha.pa.us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073

---------------------------(end of broadcast)---------------------------
TIP 1: if posting/reading through Usenet, please send an appropriate
subscribe-nomail command to majordomo@postgresql.org so that your
message can get through to the mailing list cleanly

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #9 (permalink)  
Old 04-11-2008, 08:02 AM
Stephen Frost
 
Posts: n/a
Default Re: Krb5 & multiple DB connections

* Bruce Momjian (pgman@candle.pha.pa.us) wrote:
> Is this something we need for 8.1.X?


Personally, I think it's a bug which should be fixed. I don't think
everyone agrees on that though and there are some parts which could be a
bit controversial. The main issue is that now the entire Kerberos
context is recreated on each connection. Now, it's really not all that
expensive generally but I can understand the preference to just reopen
the ccache when it changes. I tried to do that by just free'ing and
redo'ing the parts having to do w/ the ccache but it didn't quite pan
out right and I havn't figured out what I did wrong yet. The other
approach would be to actually track the cache name and check if it
changes. That's more difficult to do correctly across platforms though
I think.

Thanks,

Stephen

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFD75qOrzgMPqB3kigRAlRpAJ9cBFhgr4DPT39Iii60kq FcSQzBswCfVd9G
9NOQxNTT02nzdG+bh7amP94=
=W7U/
-----END PGP SIGNATURE-----

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #10 (permalink)  
Old 04-11-2008, 08:02 AM
Bruce Momjian
 
Posts: n/a
Default Re: Krb5 & multiple DB connections


Then the patch safest for just 8.2 then.

---------------------------------------------------------------------------

Stephen Frost wrote:
-- Start of PGP signed section.
> * Bruce Momjian (pgman@candle.pha.pa.us) wrote:
> > Is this something we need for 8.1.X?

>
> Personally, I think it's a bug which should be fixed. I don't think
> everyone agrees on that though and there are some parts which could be a
> bit controversial. The main issue is that now the entire Kerberos
> context is recreated on each connection. Now, it's really not all that
> expensive generally but I can understand the preference to just reopen
> the ccache when it changes. I tried to do that by just free'ing and
> redo'ing the parts having to do w/ the ccache but it didn't quite pan
> out right and I havn't figured out what I did wrong yet. The other
> approach would be to actually track the cache name and check if it
> changes. That's more difficult to do correctly across platforms though
> I think.
>
> Thanks,
>
> Stephen

-- End of PGP section, PGP failed!

--
Bruce Momjian | http://candle.pha.pa.us
pgman@candle.pha.pa.us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073

---------------------------(end of broadcast)---------------------------
TIP 6: explain analyze is your friend

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


All times are GMT. The time now is 10:04 PM.


Powered by vBulletin® Version 3.6.5
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.2.0
www.UnixAdminTalk.com