gss_accept_delegation

Definition PG 18 manual

Sets whether GSSAPI delegation should be accepted from the client. The default is off meaning credentials from the client will not be accepted. Changing this to on will make the server accept credentials delegated to it from the client. This parameter can only be set in the postgresql.conf file or on the server command line.

How it works

gss_accept_delegation sets whether GSSAPI delegation should be accepted from the client. Accepting delegated credentials lets server-side code act with the client's GSS identity, so it expands trust beyond ordinary authentication.

gss_accept_delegation is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value.

The final authentication path combines this setting with pg_hba.conf, role attributes, credential material, client capabilities, and sometimes operating-system identity services.

Operational considerations

Editing gss_accept_delegation without reloading configuration and verifying the effective value and subsequent behavior.

Changing one authentication setting without testing pg_hba.conf ordering, existing secrets, mappings, and every client library.

Weakening identity policy to solve connection churn or CPU cost that should be addressed with pooling and capacity planning.

Changing gss_accept_delegation globally without a rollback plan and a client or operational compatibility test.

Workload guidance

OLAP: Apply the same security baseline to analytical access; isolate any legacy client exception to a dedicated role and a dated migration plan.

OLTP: Set gss_accept_delegation from the authentication architecture and security policy, not workload throughput. Test every driver, identity mapping, failover path, and credential-rotation procedure.

SMALL: Prefer the current secure default for gss_accept_delegation. Avoid weakening authentication to save marginal CPU on a small node; reduce connection churn with pooling instead.