<div dir="ltr"> <div class="gmail_extra">I should add the role every time then add ipa users ? For example, i have one role for PostgreSQL, and after add a new IPA user, i should add mapping for this new user ? Or it would be made automaticaly ? <div class="gmail_quote">On Mon, Sep 30, 2013 at 7:03 PM, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"> <div class=""><div class="h5">On Mon, 30 Sep 2013, Gorbachev Ivan wrote: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"> Hi! Sorry for my English. Can you help me. I try to add PostgreSQL authentication to IPA. Server of IPA host name - server.my.domain.local database PostgreSQL host name - database.my.domain.local 1. pg_hba.conf – add record host all all <a href="http://192.168.0.0/24" target="_blank">192.168.0.0/24</a> gss 2. postgresql.conf add records: # Kerberos and GSSAPI krb_server_keyfile = '/var/lib/pgsql/9.2/data/pg.keytab' krb_srvname = 'postgres' # (Kerberos only) 3. Add PostgreSQL service: ipa service-add postgres/server.my.domain.local 4. Create keytab: ipa-getkeytab -s server.my.domain.local -p postgres/database.my.domain.local@MY.DOMAIN.LOCAL -k /var/lib/pgsql/data/9.2/pg.keytab 5. Change owner: chown postgres:postgres /var/lib/pgsql/9.2/data/pg.keytab 6. restart PostgreSQL service 7. Try to connect from database host: psql -h database.my.domain.local If I try – “psql -h database.my.domain.local” command, I have an error – “psql: FATAL: role "rembo" does not exist” </blockquote></div></div> So authentication passes in this case but you don't have proper role defined. Define a role called 'rembo'. See <a href="http://www.postgresql.org/docs/9.2/static/database-roles.html" target="_blank">http://www.postgresql.org/docs/9.2/static/database-roles.html</a><div><div class="h5"> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"> If I try –“ psql -h database.my.domain.local -U rembo@MY.DOMAIN.LOCAL” command, I have an error “psql: FATAL: GSSAPI authentication failed for user rembo@MY.DOMAIN.LOCAL" database.my.domain.local host’s authentication method – IPA. This is PostgreSQL log: DEBUG: InitPostgres DEBUG: my backend ID is 1 DEBUG: StartTransaction DEBUG: checkpointer updated shared memory configuration values DEBUG: name: unnamed; blockState: DEFAULT; state: INPROGR, xid/subid/cid: 0/1/0, nestlvl: 1, children: DEBUG: CommitTransaction DEBUG: name: unnamed; blockState: STARTED; state: INPROGR, xid/subid/cid: 0/1/0, nestlvl: 1, children: DEBUG: forked new backend, pid=17203 socket=11 DEBUG: postmaster child[17203]: starting with ( DEBUG: postgres DEBUG: rembo@MY.DOMAIN.LOCAL DEBUG: ) DEBUG: InitPostgres DEBUG: my backend ID is 2 DEBUG: StartTransaction DEBUG: name: unnamed; blockState: DEFAULT; state: INPROGR, xid/subid/cid: 0/1/0, nestlvl: 1, children: DEBUG: Processing received GSS token of length 654 DEBUG: gss_accept_sec_context major: 0, minor: 0, outlen: 156, outflags: 1b2 DEBUG: sending GSS response token of length 156 DEBUG: sending GSS token of length 156 LOG: provided user name (rembo@MY.DOMAIN.LOCAL) and authenticated user name (rembo) do not match </blockquote></div></div> You have this issue because your username and mapped name do not match. -- / Alexander Bokovoy </blockquote></div> <div> </div>-- <div>With Best Regards</div><div>Gorbachev Ivan</div> </div></div>