diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml
index 93040bd31d184c8f60af377443112a627dea1982..c209dd39e9df872863facfee14d07d312a3e31f5 100644
--- a/doc/src/sgml/runtime.sgml
+++ b/doc/src/sgml/runtime.sgml
@@ -1,5 +1,5 @@
<!--
-$PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.325 2005/06/13 02:40:06 neilc Exp $
+$PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.326 2005/06/14 17:43:12 momjian Exp $
-->
<chapter Id="runtime">
@@ -969,24 +969,44 @@ SET ENABLE_SEQSCAN TO OFF;
<listitem>
<para>
Sets the Kerberos service name. See <xref linkend="kerberos-auth">
- for details. This parameter can only be set at server start.
+ for details. This parameter can only be set at server start.
</para>
</listitem>
</varlistentry>
- <varlistentry id="guc-krb-caseins-users" xreflabel="krb_caseins_users">
- <term><varname>krb_caseins_users</varname> (<type>boolean</type>)</term>
- <indexterm>
- <primary><varname>krb_caseins_users</varname> configuration parameter</primary>
+ <varlistentry id="guc-krb-caseins-users" xreflabel="krb_caseins_users">
+ <term><varname>krb_caseins_users</varname> (<type>boolean</type>)</term>
+ <indexterm>
+ <primary><varname>krb_caseins_users</varname> configuration parameter</primary>
</indexterm>
- <listitem>
- <para>
- Sets if Kerberos usernames should be treated case-insensitive.
- The default is off (case sensitive). This parameter can only be
- set at server start.
+ <listitem>
+ <para>
+ Sets if Kerberos usernames should be treated case-insensitive.
+ The default is off (case sensitive). This parameter can only be
+ set at server start.
</para>
- </listitem>
- </varlistentry>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry id="guc-krb-server-hostname" xreflabel="krb_server_hostname">
+ <term><varname>krb_server_hostname</varname> (<type>string</type>)</term>
+ <indexterm>
+ <primary><varname>krb_server_hostname</> configuration parameter</primary>
+ </indexterm>
+ <listitem>
+ <para>
+ Sets the hostname part of the service principal.
+ This, combined with <varname>krb_srvname</>, is used to generate
+ the complete service principal, i.e.
+ <varname>krb_server_hostname</><literal>/</><varname>krb_server_hostname</><literal>@</>REALM.
+ </para>
+ <para>
+ If not set, the default is to allow any service principal matching an entry
+ in the keytab. See <xref linkend="kerberos-auth"> for details.
+ This parameter can only be set at server start.
+ </para>
+ </listitem>
+ </varlistentry>
<varlistentry id="guc-db-user-namespace" xreflabel="db_user_namespace">
<term><varname>db_user_namespace</varname> (<type>boolean</type>)</term>
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index 7970f817561bbac85eac1ef6ecfa07932674bb2f..a50227068ba4692d130be3b27aab90cc6086195e 100644
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.124 2005/06/04 20:42:42 momjian Exp $
+ * $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.125 2005/06/14 17:43:13 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@@ -43,6 +43,7 @@ static int recv_and_check_password_packet(Port *port);
char *pg_krb_server_keyfile;
char *pg_krb_srvnam;
bool pg_krb_caseins_users;
+char *pg_krb_server_hostname = NULL;
#ifdef USE_PAM
#ifdef HAVE_PAM_PAM_APPL_H
@@ -221,20 +222,25 @@ pg_krb5_init(void)
return STATUS_ERROR;
}
- retval = krb5_sname_to_principal(pg_krb5_context, NULL, pg_krb_srvnam,
- KRB5_NT_SRV_HST, &pg_krb5_server);
- if (retval)
+ if (pg_krb_server_hostname)
{
- ereport(LOG,
- (errmsg("Kerberos sname_to_principal(\"%s\") returned error %d",
- pg_krb_srvnam, retval)));
- com_err("postgres", retval,
- "while getting server principal for service \"%s\"",
- pg_krb_srvnam);
- krb5_kt_close(pg_krb5_context, pg_krb5_keytab);
- krb5_free_context(pg_krb5_context);
- return STATUS_ERROR;
- }
+ retval = krb5_sname_to_principal(pg_krb5_context,
+ pg_krb_server_hostname, pg_krb_srvnam,
+ KRB5_NT_SRV_HST, &pg_krb5_server);
+ if (retval)
+ {
+ ereport(LOG,
+ (errmsg("Kerberos sname_to_principal(\"%s\") returned error %d",
+ pg_krb_srvnam, retval)));
+ com_err("postgres", retval,
+ "while getting server principal for service \"%s\"",
+ pg_krb_srvnam);
+ krb5_kt_close(pg_krb5_context, pg_krb5_keytab);
+ krb5_free_context(pg_krb5_context);
+ return STATUS_ERROR;
+ }
+ } else
+ pg_krb5_server = NULL;
pg_krb5_initialised = 1;
return STATUS_OK;
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 3d57509548f46ff74dcefd832050192b7caa83e1..073aae2a2357a77e11f391ff7f922d323e7842b4 100644
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -10,7 +10,7 @@
* Written by Peter Eisentraut <peter_e@gmx.net>.
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.264 2005/06/04 20:42:42 momjian Exp $
+ * $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.265 2005/06/14 17:43:13 momjian Exp $
*
*--------------------------------------------------------------------
*/
@@ -1593,6 +1593,15 @@ static struct config_string ConfigureNamesString[] =
PG_KRB_SRVNAM, NULL, NULL
},
+ {
+ {"krb_server_hostname", PGC_POSTMASTER, CONN_AUTH_SECURITY,
+ gettext_noop("Sets the hostname of the Kerberos server."),
+ NULL
+ },
+ &pg_krb_server_hostname,
+ NULL, NULL, NULL
+ },
+
{
{"bonjour_name", PGC_POSTMASTER, CONN_AUTH_SETTINGS,
gettext_noop("Sets the Bonjour broadcast service name."),
diff --git a/src/bin/psql/tab-complete.c b/src/bin/psql/tab-complete.c
index 3d1ce4ca122d759645fb378ccdeb672ecd862bc8..2b215d97286d5c5e7ceaec378b9a6383734c5245 100644
--- a/src/bin/psql/tab-complete.c
+++ b/src/bin/psql/tab-complete.c
@@ -3,7 +3,7 @@
*
* Copyright (c) 2000-2005, PostgreSQL Global Development Group
*
- * $PostgreSQL: pgsql/src/bin/psql/tab-complete.c,v 1.130 2005/05/25 22:12:05 momjian Exp $
+ * $PostgreSQL: pgsql/src/bin/psql/tab-complete.c,v 1.131 2005/06/14 17:43:14 momjian Exp $
*/
/*----------------------------------------------------------------------
@@ -559,7 +559,6 @@ psql_completion(char *text, int start, int end)
"geqo_selection_bias",
"geqo_threshold",
"join_collapse_limit",
- "krb_server_keyfile",
"lc_messages",
"lc_monetary",
"lc_numeric",
diff --git a/src/include/libpq/auth.h b/src/include/libpq/auth.h
index b8fd25eb64f6c9620d1b8b90efb1bbacc71b5924..94b0976e113a3dc4ee1e3cd5c57dda9906baac6a 100644
--- a/src/include/libpq/auth.h
+++ b/src/include/libpq/auth.h
@@ -7,7 +7,7 @@
* Portions Copyright (c) 1996-2005, PostgreSQL Global Development Group
* Portions Copyright (c) 1994, Regents of the University of California
*
- * $PostgreSQL: pgsql/src/include/libpq/auth.h,v 1.27 2005/06/04 20:42:42 momjian Exp $
+ * $PostgreSQL: pgsql/src/include/libpq/auth.h,v 1.28 2005/06/14 17:43:14 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@@ -29,5 +29,6 @@ extern void ClientAuthentication(Port *port);
extern char *pg_krb_server_keyfile;
extern char *pg_krb_srvnam;
extern bool pg_krb_caseins_users;
+extern char *pg_krb_server_hostname;
#endif /* AUTH_H */