krb_caseins_users

Definition PG 18 manual

Sets whether GSSAPI user names should be treated case-insensitively. The default is off (case sensitive). This parameter can only be set in the postgresql.conf file or on the server command line.

How it works

krb_caseins_users sets whether Kerberos and GSSAPI user names should be treated as case-insensitive. It affects comparison of authenticated Kerberos/GSS names with database role names; case folding can merge identities that an existing mapping treated as distinct.

krb_caseins_users is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value.

The final authentication path combines this setting with pg_hba.conf, role attributes, credential material, client capabilities, and sometimes operating-system identity services.

Operational considerations

Editing krb_caseins_users without reloading configuration and verifying the effective value and subsequent behavior.

Changing one authentication setting without testing pg_hba.conf ordering, existing secrets, mappings, and every client library.

Weakening identity policy to solve connection churn or CPU cost that should be addressed with pooling and capacity planning.

Changing krb_caseins_users globally without a rollback plan and a client or operational compatibility test.

Workload guidance

OLAP: Apply the same security baseline to analytical access; isolate any legacy client exception to a dedicated role and a dated migration plan.

OLTP: Set krb_caseins_users from the authentication architecture and security policy, not workload throughput. Test every driver, identity mapping, failover path, and credential-rotation procedure.

SMALL: Prefer the current secure default for krb_caseins_users. Avoid weakening authentication to save marginal CPU on a small node; reduce connection churn with pooling instead.