All Your GUCs in a Row: gss_accept_delegation

PostgreSQL 16 introduced the gss_accept_delegation GUC, which allows a PostgreSQL server to accept forwarded Kerberos credentials from clients and use them to authenticate to downstream services (like a second PostgreSQL server via postgres_fdw or dblink) as the original user. This enables true single sign-on across server hops with per-user authorization preserved. However, it defaults to off because enabling it means the server holds live, usable Kerberos credentials in memory — dramatically expanding the blast radius of a server compromise beyond just the local database. Enabling delegation requires four conditions to align simultaneously: the server GUC set to on, the client opting in via gssdelegation=1, the pg_hba.conf line permitting it, and forwardable Kerberos tickets. The pg_stat_gssapi view's credentials_delegated column lets administrators verify which connections are actually using delegation.

Source: https://postgr.es/p/9qB. 8sync News only summarizes and links out; content copyright belongs to the authors and original sources.