{"Entry":{"collection":"auth","key":"sspi","name":"sspi","aliases":[],"metadata":{"aliases":[],"category":"Authentication and access control","content_hash":"a811f463a541033670d20ca78c38f525a78c9d829b11fdb5eac072c17ae757c8","derived_content_hash":"ec7ab2d274000fdf7a86d83e9bf0d90ceb74696966aaf8f948b88423dcf37de1","imported_at":"2026-09-30T00:40:33.355547+08:00","name":"sspi","name_zh":"","slug":"sspi","summary":"Use SSPI to authenticate the user. This is only available on Windows. See Section 20.7 for details."}},"Definition":{"Collection":"auth","Key":"sspi","SourceDatabase":"center","Version":"18","SourceTable":"authentication_method","SourceKey":"sspi","SourceRevision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","Facts":{"aliases":[],"attributes":{"configuration":"pg_hba.conf","inventory":"User-visible source authentication method","method":"sspi"},"comparison_data":{"documented_option_names":["compat_realm","include_realm","krb_realm","map","upn_username"],"method":"sspi"},"comparison_hash":"0220f8a01c511536c8f908389cce9eb03bab3d3ab8ba3aa2bd8f685651f29377","description":["Use SSPI to authenticate the user. This is only available on Windows. See Section 20.7 for details."],"description_zh":"认证方法 sspi。","description_zh_html":"\u003cp\u003e认证方法 sspi。\u003c/p\u003e\u003cdl\u003e\u003cdt\u003e索引访问方法\u003c/dt\u003e\u003cdd\u003e\u003ccode\u003esspi\u003c/code\u003e\u003c/dd\u003e\u003cdt\u003e配置\u003c/dt\u003e\u003cdd\u003e\u003ccode\u003epg_hba.conf\u003c/code\u003e\u003c/dd\u003e\u003c/dl\u003e\u003ch3\u003e同版本中文手册节选\u003c/h3\u003e\u003cp\u003e\n\u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e 是一种用于安全认证和单点登录的 \u003cspan class=\"productname\"\u003eWindows\u003c/span\u003e 技术。\u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 将在 \u003ccode class=\"literal\"\u003enegotiate\u003c/code\u003e 模式下使用 SSPI，该模式会在可能时使用 \u003cspan class=\"productname\"\u003eKerberos\u003c/span\u003e，并在其他情况下自动回退到 \u003cspan class=\"productname\"\u003eNTLM\u003c/span\u003e。\u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e 和 \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e 作为客户端和服务器是可互操作的，例如，\u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e 客户端可以向 \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e 服务器完成认证。建议在 Windows 客户端和服务器上使用 \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e，在非 Windows 平台上使用 \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e。\n\u003c/p\u003e\u003cp\u003e\n    当使用 \u003cspan class=\"productname\"\u003eKerberos\u003c/span\u003e 认证时，\u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e 和 \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e 的工作方式相同，详见\u003ca class=\"xref\" href=\"/zh/docs/18/gssapi-auth.html\"\u003e第 20.6 节\u003c/a\u003e。\n   \u003c/p\u003e\u003cp\u003e\n\u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e 支持下列配置选项：\n    \u003c/p\u003e\u003cp\u003e\u003ca href=\"/zh/docs/18/sspi-auth.html\"\u003e查看完整中文手册与上下文\u003c/a\u003e。\u003c/p\u003e","facts":[{"label":"Method","value":"sspi"},{"label":"Configuration","value":"pg_hba.conf"},{"label":"Inventory","value":"User-visible source authentication method"}],"facts_zh":[{"label":"方法","value":"sspi"},{"label":"配置","value":"pg_hba.conf"},{"label":"清单","value":"用户可见的源码认证方法"}],"manual_html":"\u003cdiv class=\"sect1\" id=\"SSPI-AUTH\"\u003e\n\u003cdiv class=\"titlepage\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2 class=\"title\"\u003e20.7. SSPI Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003e\u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e is a \u003cspan class=\"productname\"\u003eWindows\u003c/span\u003e technology for secure authentication with single sign-on. \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e will use SSPI in \u003ccode class=\"literal\"\u003enegotiate\u003c/code\u003e mode, which will use \u003cspan class=\"productname\"\u003eKerberos\u003c/span\u003e when possible and automatically fall back to \u003cspan class=\"productname\"\u003eNTLM\u003c/span\u003e in other cases. \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e and \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e interoperate as clients and servers, e.g., an \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e client can authenticate to an \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e server. It is recommended to use \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e on Windows clients and servers and \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e on non-Windows platforms.\u003c/p\u003e\n\u003cp\u003eWhen using \u003cspan class=\"productname\"\u003eKerberos\u003c/span\u003e authentication, \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e works the same way \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e does; see \u003ca class=\"xref\" href=\"/docs/18/gssapi-auth.html\" title=\"20.6. GSSAPI Authentication\"\u003eSection 20.6\u003c/a\u003e for details.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf set to 0, the realm name from the authenticated user principal is stripped off before being passed through the user name mapping (\u003ca class=\"xref\" href=\"/docs/18/auth-username-maps.html\" title=\"20.2. User Name Maps\"\u003eSection 20.2\u003c/a\u003e). This is discouraged and is primarily available for backwards compatibility, as it is not secure in multi-realm environments unless \u003ccode class=\"literal\"\u003ekrb_realm\u003c/code\u003e is also used. It is recommended to leave \u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e set to the default (1) and to provide an explicit mapping in \u003ccode class=\"filename\"\u003epg_ident.conf\u003c/code\u003e to convert principal names to \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e user names.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003ecompat_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf set to 1, the domain's SAM-compatible name (also known as the NetBIOS name) is used for the \u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e option. This is the default. If set to 0, the true realm name from the Kerberos user principal name is used.\u003c/p\u003e\n\u003cp\u003eDo not disable this option unless your server runs under a domain account (this includes virtual service accounts on a domain member system) and all clients authenticating through SSPI are also using domain accounts, or authentication will fail.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eupn_username\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf this option is enabled along with \u003ccode class=\"literal\"\u003ecompat_realm\u003c/code\u003e, the user name from the Kerberos UPN is used for authentication. If it is disabled (the default), the SAM-compatible user name is used. By default, these two names are identical for new user accounts.\u003c/p\u003e\n\u003cp\u003eNote that \u003cspan class=\"application\"\u003elibpq\u003c/span\u003e uses the SAM-compatible name if no explicit user name is specified. If you use \u003cspan class=\"application\"\u003elibpq\u003c/span\u003e or a driver based on it, you should leave this option disabled or explicitly specify user name in the connection string.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003emap\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAllows for mapping between system and database user names. See \u003ca class=\"xref\" href=\"/docs/18/auth-username-maps.html\" title=\"20.2. User Name Maps\"\u003eSection 20.2\u003c/a\u003e for details. For an SSPI/Kerberos principal, such as \u003ccode class=\"literal\"\u003eusername@EXAMPLE.COM\u003c/code\u003e (or, less commonly, \u003ccode class=\"literal\"\u003eusername/hostbased@EXAMPLE.COM\u003c/code\u003e), the user name used for mapping is \u003ccode class=\"literal\"\u003eusername@EXAMPLE.COM\u003c/code\u003e (or \u003ccode class=\"literal\"\u003eusername/hostbased@EXAMPLE.COM\u003c/code\u003e, respectively), unless \u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e has been set to 0, in which case \u003ccode class=\"literal\"\u003eusername\u003c/code\u003e (or \u003ccode class=\"literal\"\u003eusername/hostbased\u003c/code\u003e) is what is seen as the system user name when mapping.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003ekrb_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eSets the realm to match user principal names against. If this parameter is set, only users of that realm will be accepted. If it is not set, users of any realm can connect, subject to whatever user name mapping is done.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003c/div\u003e","manual_path":"/docs/18/sspi-auth.html","related":[],"release":{"catalog_fingerprint":"65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502","channel":"stable","label":"18.6","major":"18","ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sections":[],"sections_zh":[],"signature":"","sources":[{"label":"Matching PostgreSQL source archive","sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"label":"PostgreSQL 18 English manual","path":"sspi-auth.html","sha256":"9ea88dc9d2eef123fe15041dd161acafa11c32ff992d125337c640727997cb55","url":"/docs/18/sspi-auth.html"},{"label":"PostgreSQL 18 English manual","path":"auth-pg-hba-conf.html","sha256":"6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9","url":"/docs/18/auth-pg-hba-conf.html"}],"tables":[{"columns":[{"key":"name","label":"Option or term"},{"key":"description","label":"Meaning"}],"key":"method-options","rows":[{"description":"If set to 0, the realm name from the authenticated user principal is stripped off before being passed through the user name mapping ( Section 20.2 ). This is discouraged and is primarily available for backwards compatibility, as it is not secure in multi-realm environments unless krb_realm is also used. It is recommended to leave include_realm set to the default (1) and to provide an explicit mapping in pg_ident.conf to convert principal names to PostgreSQL user names.","name":"include_realm"},{"description":"If set to 1, the domain's SAM-compatible name (also known as the NetBIOS name) is used for the include_realm option. This is the default. If set to 0, the true realm name from the Kerberos user principal name is used. Do not disable this option unless your server runs under a domain account (this includes virtual service accounts on a domain member system) and all clients authenticating through SSPI are also using domain accounts, or authentication will fail.","name":"compat_realm"},{"description":"If this option is enabled along with compat_realm , the user name from the Kerberos UPN is used for authentication. If it is disabled (the default), the SAM-compatible user name is used. By default, these two names are identical for new user accounts. Note that libpq uses the SAM-compatible name if no explicit user name is specified. If you use libpq or a driver based on it, you should leave this option disabled or explicitly specify user name in the connection string.","name":"upn_username"},{"description":"Allows for mapping between system and database user names. See Section 20.2 for details. For an SSPI/Kerberos principal, such as username@EXAMPLE.COM (or, less commonly, username/hostbased@EXAMPLE.COM ), the user name used for mapping is username@EXAMPLE.COM (or username/hostbased@EXAMPLE.COM , respectively), unless include_realm has been set to 0, in which case username (or username/hostbased ) is what is seen as the system user name when mapping.","name":"map"},{"description":"Sets the realm to match user principal names against. If this parameter is set, only users of that realm will be accepted. If it is not set, users of any realm can connect, subject to whatever user name mapping is done.","name":"krb_realm"}],"title":"Documented method options and alternatives"}],"tables_zh":[{"columns":[{"key":"name","label":"选项或术语"},{"key":"description","label":"含义"}],"key":"method-options","rows":[{"description":"如果设为 0，则在通过用户名映射（ 第 20.2 节 ）之前，会先从已认证用户的主体名中去掉 realm 名称。不建议这样做；它主要是为了向后兼容而保留的，因为在多 realm 环境中这并不安全，除非同时使用了 krb_realm 。建议将 include_realm 保持为默认值（1），并在 pg_ident.conf 中提供显式映射，把主体名转换成 PostgreSQL 用户名。","name":"include_realm"},{"description":"如果设为 1，则会在 include_realm 选项中使用域的 SAM 兼容名称（也称为 NetBIOS 名称）。这是默认值。如果设为 0，则会使用 Kerberos 用户主体名中的真实 realm 名称。 只有当服务器运行在域账号（包括域成员系统上的虚拟服务账号）下，并且所有通过 SSPI 认证的客户端也都使用域账号时，才可禁用此选项；否则，禁用此选项会导致认证失败。","name":"compat_realm"},{"description":"如果此选项与 compat_realm 一起启用，则认证时会使用 Kerberos UPN 中的用户名。如果禁用它（默认值），则使用 SAM 兼容用户名。默认情况下，对新建用户账号而言，这两个名称是相同的。 注意，如果没有显式指定用户名， libpq 会使用 SAM 兼容名称。如果你使用的是 libpq 或基于它的驱动，应当保持该选项为禁用状态，或者在连接字符串中显式指定用户名。","name":"upn_username"},{"description":"允许在系统用户名和数据库用户名之间进行映射。详见 第 20.2 节 。对于 SSPI/Kerberos 主体，例如 username@EXAMPLE.COM （或者较少见的 username/hostbased@EXAMPLE.COM ），用于映射的用户名分别是 username@EXAMPLE.COM （或 username/hostbased@EXAMPLE.COM ），除非已经将 include_realm 设为 0；在那种情况下，映射时视为系统用户名的是 username （或 username/hostbased ）。","name":"map"},{"description":"设置用于匹配用户主体名的 realm。如果设置了该参数，则只接受来自该 realm 的用户；如果未设置，则允许来自任意 realm 的用户连接，但仍受已执行的用户名映射约束。","name":"krb_realm"}],"title":"手册中的方法选项与替代方式"}],"zh_from":{"authored_translation":"source-derived-structured-summary","body_sha256":"eb1b526cf649906735b236c1a207d0bceb3b64ec16b31a2ccb7611982d24fd99","kind":"same-version-chinese-manual-with-source-derived-structured-summary","manual":{"anchor":"","build_id":107,"extraction":"concept-introduction","fragment_sha256":"0fe20218571376563a97fbaf2a0487387b75101061bf33935a76fe229b410d7f","locale":"zh-Hans","page_key":"sspi-auth.html","source_hash":"9b3fd04fbd44b6b70a21407a92b8e116cb41f411e29654034f139add23ad47a2","source_revision":"unknown:rendered-translation-baseline","translated_from_revision":null,"translation_revision":"git:b1b500221dbe5437cfca004d6b04d3f6e422765d;html-sha256:08e987a66af27b98444a8057c256314eafa13611a3fb9e888214fc436824244b","url":"/zh/docs/18/sspi-auth.html","version":"18"},"runtime_rerun":false,"source_facts_revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"}},"ManualEvidence":{"manual_path":"/docs/18/sspi-auth.html","release":{"catalog_fingerprint":"65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502","channel":"stable","label":"18.6","major":"18","ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sources":[{"label":"Matching PostgreSQL source archive","sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"label":"PostgreSQL 18 English manual","path":"sspi-auth.html","sha256":"9ea88dc9d2eef123fe15041dd161acafa11c32ff992d125337c640727997cb55","url":"/docs/18/sspi-auth.html"},{"label":"PostgreSQL 18 English manual","path":"auth-pg-hba-conf.html","sha256":"6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9","url":"/docs/18/auth-pg-hba-conf.html"}]},"MeasuredEvidence":{}},"Text":{"Collection":"auth","Key":"sspi","SourceDatabase":"center","Version":"18","Locale":"en","Title":"sspi","Summary":"Use SSPI to authenticate the user. This is only available on Windows. See Section 20.7 for details.","BodyHTML":"\u003cdiv id=\"SSPI-AUTH\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2\u003e20.7. SSPI Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003e\u003cspan\u003eSSPI\u003c/span\u003e is a \u003cspan\u003eWindows\u003c/span\u003e technology for secure authentication with single sign-on. \u003cspan\u003ePostgreSQL\u003c/span\u003e will use SSPI in \u003ccode\u003enegotiate\u003c/code\u003e mode, which will use \u003cspan\u003eKerberos\u003c/span\u003e when possible and automatically fall back to \u003cspan\u003eNTLM\u003c/span\u003e in other cases. \u003cspan\u003eSSPI\u003c/span\u003e and \u003cspan\u003eGSSAPI\u003c/span\u003e interoperate as clients and servers, e.g., an \u003cspan\u003eSSPI\u003c/span\u003e client can authenticate to an \u003cspan\u003eGSSAPI\u003c/span\u003e server. It is recommended to use \u003cspan\u003eSSPI\u003c/span\u003e on Windows clients and servers and \u003cspan\u003eGSSAPI\u003c/span\u003e on non-Windows platforms.\u003c/p\u003e\n\u003cp\u003eWhen using \u003cspan\u003eKerberos\u003c/span\u003e authentication, \u003cspan\u003eSSPI\u003c/span\u003e works the same way \u003cspan\u003eGSSAPI\u003c/span\u003e does; see \u003ca href=\"/docs/18/gssapi-auth.html\" rel=\"nofollow\"\u003eSection 20.6\u003c/a\u003e for details.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for \u003cspan\u003eSSPI\u003c/span\u003e:\u003c/p\u003e\n\u003cdiv\u003e\n\u003cdl\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003einclude_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf set to 0, the realm name from the authenticated user principal is stripped off before being passed through the user name mapping (\u003ca href=\"/docs/18/auth-username-maps.html\" rel=\"nofollow\"\u003eSection 20.2\u003c/a\u003e). This is discouraged and is primarily available for backwards compatibility, as it is not secure in multi-realm environments unless \u003ccode\u003ekrb_realm\u003c/code\u003e is also used. It is recommended to leave \u003ccode\u003einclude_realm\u003c/code\u003e set to the default (1) and to provide an explicit mapping in \u003ccode\u003epg_ident.conf\u003c/code\u003e to convert principal names to \u003cspan\u003ePostgreSQL\u003c/span\u003e user names.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003ecompat_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf set to 1, the domain\u0026#39;s SAM-compatible name (also known as the NetBIOS name) is used for the \u003ccode\u003einclude_realm\u003c/code\u003e option. This is the default. If set to 0, the true realm name from the Kerberos user principal name is used.\u003c/p\u003e\n\u003cp\u003eDo not disable this option unless your server runs under a domain account (this includes virtual service accounts on a domain member system) and all clients authenticating through SSPI are also using domain accounts, or authentication will fail.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eupn_username\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf this option is enabled along with \u003ccode\u003ecompat_realm\u003c/code\u003e, the user name from the Kerberos UPN is used for authentication. If it is disabled (the default), the SAM-compatible user name is used. By default, these two names are identical for new user accounts.\u003c/p\u003e\n\u003cp\u003eNote that \u003cspan\u003elibpq\u003c/span\u003e uses the SAM-compatible name if no explicit user name is specified. If you use \u003cspan\u003elibpq\u003c/span\u003e or a driver based on it, you should leave this option disabled or explicitly specify user name in the connection string.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003emap\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAllows for mapping between system and database user names. See \u003ca href=\"/docs/18/auth-username-maps.html\" rel=\"nofollow\"\u003eSection 20.2\u003c/a\u003e for details. For an SSPI/Kerberos principal, such as \u003ccode\u003eusername@EXAMPLE.COM\u003c/code\u003e (or, less commonly, \u003ccode\u003eusername/hostbased@EXAMPLE.COM\u003c/code\u003e), the user name used for mapping is \u003ccode\u003eusername@EXAMPLE.COM\u003c/code\u003e (or \u003ccode\u003eusername/hostbased@EXAMPLE.COM\u003c/code\u003e, respectively), unless \u003ccode\u003einclude_realm\u003c/code\u003e has been set to 0, in which case \u003ccode\u003eusername\u003c/code\u003e (or \u003ccode\u003eusername/hostbased\u003c/code\u003e) is what is seen as the system user name when mapping.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003ekrb_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eSets the realm to match user principal names against. If this parameter is set, only users of that realm will be accepted. If it is not set, users of any realm can connect, subject to whatever user name mapping is done.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003c/div\u003e","SourceRevision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","ContentHash":"cc663997ef2f03348d18e8fe11a395a53f1ab72509d0c44085204251f25489f3","Payload":{"description":["Use SSPI to authenticate the user. This is only available on Windows. See Section 20.7 for details."],"manual_html":"\u003cdiv class=\"sect1\" id=\"SSPI-AUTH\"\u003e\n\u003cdiv class=\"titlepage\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2 class=\"title\"\u003e20.7. SSPI Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003e\u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e is a \u003cspan class=\"productname\"\u003eWindows\u003c/span\u003e technology for secure authentication with single sign-on. \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e will use SSPI in \u003ccode class=\"literal\"\u003enegotiate\u003c/code\u003e mode, which will use \u003cspan class=\"productname\"\u003eKerberos\u003c/span\u003e when possible and automatically fall back to \u003cspan class=\"productname\"\u003eNTLM\u003c/span\u003e in other cases. \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e and \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e interoperate as clients and servers, e.g., an \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e client can authenticate to an \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e server. It is recommended to use \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e on Windows clients and servers and \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e on non-Windows platforms.\u003c/p\u003e\n\u003cp\u003eWhen using \u003cspan class=\"productname\"\u003eKerberos\u003c/span\u003e authentication, \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e works the same way \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e does; see \u003ca class=\"xref\" href=\"/docs/18/gssapi-auth.html\" title=\"20.6. GSSAPI Authentication\"\u003eSection 20.6\u003c/a\u003e for details.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf set to 0, the realm name from the authenticated user principal is stripped off before being passed through the user name mapping (\u003ca class=\"xref\" href=\"/docs/18/auth-username-maps.html\" title=\"20.2. User Name Maps\"\u003eSection 20.2\u003c/a\u003e). This is discouraged and is primarily available for backwards compatibility, as it is not secure in multi-realm environments unless \u003ccode class=\"literal\"\u003ekrb_realm\u003c/code\u003e is also used. It is recommended to leave \u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e set to the default (1) and to provide an explicit mapping in \u003ccode class=\"filename\"\u003epg_ident.conf\u003c/code\u003e to convert principal names to \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e user names.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003ecompat_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf set to 1, the domain's SAM-compatible name (also known as the NetBIOS name) is used for the \u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e option. This is the default. If set to 0, the true realm name from the Kerberos user principal name is used.\u003c/p\u003e\n\u003cp\u003eDo not disable this option unless your server runs under a domain account (this includes virtual service accounts on a domain member system) and all clients authenticating through SSPI are also using domain accounts, or authentication will fail.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eupn_username\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf this option is enabled along with \u003ccode class=\"literal\"\u003ecompat_realm\u003c/code\u003e, the user name from the Kerberos UPN is used for authentication. If it is disabled (the default), the SAM-compatible user name is used. By default, these two names are identical for new user accounts.\u003c/p\u003e\n\u003cp\u003eNote that \u003cspan class=\"application\"\u003elibpq\u003c/span\u003e uses the SAM-compatible name if no explicit user name is specified. If you use \u003cspan class=\"application\"\u003elibpq\u003c/span\u003e or a driver based on it, you should leave this option disabled or explicitly specify user name in the connection string.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003emap\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAllows for mapping between system and database user names. See \u003ca class=\"xref\" href=\"/docs/18/auth-username-maps.html\" title=\"20.2. User Name Maps\"\u003eSection 20.2\u003c/a\u003e for details. For an SSPI/Kerberos principal, such as \u003ccode class=\"literal\"\u003eusername@EXAMPLE.COM\u003c/code\u003e (or, less commonly, \u003ccode class=\"literal\"\u003eusername/hostbased@EXAMPLE.COM\u003c/code\u003e), the user name used for mapping is \u003ccode class=\"literal\"\u003eusername@EXAMPLE.COM\u003c/code\u003e (or \u003ccode class=\"literal\"\u003eusername/hostbased@EXAMPLE.COM\u003c/code\u003e, respectively), unless \u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e has been set to 0, in which case \u003ccode class=\"literal\"\u003eusername\u003c/code\u003e (or \u003ccode class=\"literal\"\u003eusername/hostbased\u003c/code\u003e) is what is seen as the system user name when mapping.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003ekrb_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eSets the realm to match user principal names against. If this parameter is set, only users of that realm will be accepted. If it is not set, users of any realm can connect, subject to whatever user name mapping is done.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003c/div\u003e","related":[],"sections":[],"tables":[{"columns":[{"key":"name","label":"Option or term"},{"key":"description","label":"Meaning"}],"key":"method-options","rows":[{"description":"If set to 0, the realm name from the authenticated user principal is stripped off before being passed through the user name mapping ( Section 20.2 ). This is discouraged and is primarily available for backwards compatibility, as it is not secure in multi-realm environments unless krb_realm is also used. It is recommended to leave include_realm set to the default (1) and to provide an explicit mapping in pg_ident.conf to convert principal names to PostgreSQL user names.","name":"include_realm"},{"description":"If set to 1, the domain's SAM-compatible name (also known as the NetBIOS name) is used for the include_realm option. This is the default. If set to 0, the true realm name from the Kerberos user principal name is used. Do not disable this option unless your server runs under a domain account (this includes virtual service accounts on a domain member system) and all clients authenticating through SSPI are also using domain accounts, or authentication will fail.","name":"compat_realm"},{"description":"If this option is enabled along with compat_realm , the user name from the Kerberos UPN is used for authentication. If it is disabled (the default), the SAM-compatible user name is used. By default, these two names are identical for new user accounts. Note that libpq uses the SAM-compatible name if no explicit user name is specified. If you use libpq or a driver based on it, you should leave this option disabled or explicitly specify user name in the connection string.","name":"upn_username"},{"description":"Allows for mapping between system and database user names. See Section 20.2 for details. For an SSPI/Kerberos principal, such as username@EXAMPLE.COM (or, less commonly, username/hostbased@EXAMPLE.COM ), the user name used for mapping is username@EXAMPLE.COM (or username/hostbased@EXAMPLE.COM , respectively), unless include_realm has been set to 0, in which case username (or username/hostbased ) is what is seen as the system user name when mapping.","name":"map"},{"description":"Sets the realm to match user principal names against. If this parameter is set, only users of that realm will be accepted. If it is not set, users of any realm can connect, subject to whatever user name mapping is done.","name":"krb_realm"}],"title":"Documented method options and alternatives"}]}},"RequestedLocale":"en","Fallback":false,"Versions":["10","11","12","13","14","15","16","17","18","19","20"],"Locales":["en","zh-Hans"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}