{"Entry":{"collection":"auth","key":"sspi","name":"sspi","aliases":[],"metadata":{"aliases":[],"category":"Authentication and access control","content_hash":"a811f463a541033670d20ca78c38f525a78c9d829b11fdb5eac072c17ae757c8","imported_at":"2026-09-30T00:40:33.355547+08:00","name":"sspi","name_zh":"","slug":"sspi","summary":"Use SSPI to authenticate the user. This is only available on Windows. See Section 20.7 for details."}},"Definition":{"Collection":"auth","Key":"sspi","SourceDatabase":"center","Version":"18","SourceTable":"authentication_method","SourceKey":"sspi","SourceRevision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","Facts":{"aliases":[],"attributes":{"configuration":"pg_hba.conf","inventory":"User-visible source authentication method","method":"sspi"},"comparison_data":{"documented_option_names":["compat_realm","include_realm","krb_realm","map","upn_username"],"method":"sspi"},"comparison_hash":"0220f8a01c511536c8f908389cce9eb03bab3d3ab8ba3aa2bd8f685651f29377","description":["Use SSPI to authenticate the user. This is only available on Windows. See Section 20.7 for details."],"facts":[{"label":"Method","value":"sspi"},{"label":"Configuration","value":"pg_hba.conf"},{"label":"Inventory","value":"User-visible source authentication method"}],"manual_html":"\u003cdiv class=\"sect1\" id=\"SSPI-AUTH\"\u003e\n\u003cdiv class=\"titlepage\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2 class=\"title\"\u003e20.7. SSPI Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003e\u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e is a \u003cspan class=\"productname\"\u003eWindows\u003c/span\u003e technology for secure authentication with single sign-on. \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e will use SSPI in \u003ccode class=\"literal\"\u003enegotiate\u003c/code\u003e mode, which will use \u003cspan class=\"productname\"\u003eKerberos\u003c/span\u003e when possible and automatically fall back to \u003cspan class=\"productname\"\u003eNTLM\u003c/span\u003e in other cases. \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e and \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e interoperate as clients and servers, e.g., an \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e client can authenticate to an \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e server. It is recommended to use \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e on Windows clients and servers and \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e on non-Windows platforms.\u003c/p\u003e\n\u003cp\u003eWhen using \u003cspan class=\"productname\"\u003eKerberos\u003c/span\u003e authentication, \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e works the same way \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e does; see \u003ca class=\"xref\" href=\"/docs/18/gssapi-auth.html\" title=\"20.6. GSSAPI Authentication\"\u003eSection 20.6\u003c/a\u003e for details.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf set to 0, the realm name from the authenticated user principal is stripped off before being passed through the user name mapping (\u003ca class=\"xref\" href=\"/docs/18/auth-username-maps.html\" title=\"20.2. User Name Maps\"\u003eSection 20.2\u003c/a\u003e). This is discouraged and is primarily available for backwards compatibility, as it is not secure in multi-realm environments unless \u003ccode class=\"literal\"\u003ekrb_realm\u003c/code\u003e is also used. It is recommended to leave \u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e set to the default (1) and to provide an explicit mapping in \u003ccode class=\"filename\"\u003epg_ident.conf\u003c/code\u003e to convert principal names to \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e user names.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003ecompat_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf set to 1, the domain's SAM-compatible name (also known as the NetBIOS name) is used for the \u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e option. This is the default. If set to 0, the true realm name from the Kerberos user principal name is used.\u003c/p\u003e\n\u003cp\u003eDo not disable this option unless your server runs under a domain account (this includes virtual service accounts on a domain member system) and all clients authenticating through SSPI are also using domain accounts, or authentication will fail.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eupn_username\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf this option is enabled along with \u003ccode class=\"literal\"\u003ecompat_realm\u003c/code\u003e, the user name from the Kerberos UPN is used for authentication. If it is disabled (the default), the SAM-compatible user name is used. By default, these two names are identical for new user accounts.\u003c/p\u003e\n\u003cp\u003eNote that \u003cspan class=\"application\"\u003elibpq\u003c/span\u003e uses the SAM-compatible name if no explicit user name is specified. If you use \u003cspan class=\"application\"\u003elibpq\u003c/span\u003e or a driver based on it, you should leave this option disabled or explicitly specify user name in the connection string.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003emap\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAllows for mapping between system and database user names. See \u003ca class=\"xref\" href=\"/docs/18/auth-username-maps.html\" title=\"20.2. User Name Maps\"\u003eSection 20.2\u003c/a\u003e for details. For an SSPI/Kerberos principal, such as \u003ccode class=\"literal\"\u003eusername@EXAMPLE.COM\u003c/code\u003e (or, less commonly, \u003ccode class=\"literal\"\u003eusername/hostbased@EXAMPLE.COM\u003c/code\u003e), the user name used for mapping is \u003ccode class=\"literal\"\u003eusername@EXAMPLE.COM\u003c/code\u003e (or \u003ccode class=\"literal\"\u003eusername/hostbased@EXAMPLE.COM\u003c/code\u003e, respectively), unless \u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e has been set to 0, in which case \u003ccode class=\"literal\"\u003eusername\u003c/code\u003e (or \u003ccode class=\"literal\"\u003eusername/hostbased\u003c/code\u003e) is what is seen as the system user name when mapping.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003ekrb_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eSets the realm to match user principal names against. If this parameter is set, only users of that realm will be accepted. If it is not set, users of any realm can connect, subject to whatever user name mapping is done.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003c/div\u003e","manual_path":"/docs/18/sspi-auth.html","related":[],"release":{"catalog_fingerprint":"65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502","channel":"stable","label":"18.6","major":"18","ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sections":[],"signature":"","sources":[{"label":"Matching PostgreSQL source archive","sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"label":"PostgreSQL 18 English manual","path":"sspi-auth.html","sha256":"9ea88dc9d2eef123fe15041dd161acafa11c32ff992d125337c640727997cb55","url":"/docs/18/sspi-auth.html"},{"label":"PostgreSQL 18 English manual","path":"auth-pg-hba-conf.html","sha256":"6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9","url":"/docs/18/auth-pg-hba-conf.html"}],"tables":[{"columns":[{"key":"name","label":"Option or term"},{"key":"description","label":"Meaning"}],"key":"method-options","rows":[{"description":"If set to 0, the realm name from the authenticated user principal is stripped off before being passed through the user name mapping ( Section 20.2 ). This is discouraged and is primarily available for backwards compatibility, as it is not secure in multi-realm environments unless krb_realm is also used. It is recommended to leave include_realm set to the default (1) and to provide an explicit mapping in pg_ident.conf to convert principal names to PostgreSQL user names.","name":"include_realm"},{"description":"If set to 1, the domain's SAM-compatible name (also known as the NetBIOS name) is used for the include_realm option. This is the default. If set to 0, the true realm name from the Kerberos user principal name is used. Do not disable this option unless your server runs under a domain account (this includes virtual service accounts on a domain member system) and all clients authenticating through SSPI are also using domain accounts, or authentication will fail.","name":"compat_realm"},{"description":"If this option is enabled along with compat_realm , the user name from the Kerberos UPN is used for authentication. If it is disabled (the default), the SAM-compatible user name is used. By default, these two names are identical for new user accounts. Note that libpq uses the SAM-compatible name if no explicit user name is specified. If you use libpq or a driver based on it, you should leave this option disabled or explicitly specify user name in the connection string.","name":"upn_username"},{"description":"Allows for mapping between system and database user names. See Section 20.2 for details. For an SSPI/Kerberos principal, such as username@EXAMPLE.COM (or, less commonly, username/hostbased@EXAMPLE.COM ), the user name used for mapping is username@EXAMPLE.COM (or username/hostbased@EXAMPLE.COM , respectively), unless include_realm has been set to 0, in which case username (or username/hostbased ) is what is seen as the system user name when mapping.","name":"map"},{"description":"Sets the realm to match user principal names against. If this parameter is set, only users of that realm will be accepted. If it is not set, users of any realm can connect, subject to whatever user name mapping is done.","name":"krb_realm"}],"title":"Documented method options and alternatives"}]},"ManualEvidence":{"manual_path":"/docs/18/sspi-auth.html","release":{"catalog_fingerprint":"65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502","channel":"stable","label":"18.6","major":"18","ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sources":[{"label":"Matching PostgreSQL source archive","sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"label":"PostgreSQL 18 English manual","path":"sspi-auth.html","sha256":"9ea88dc9d2eef123fe15041dd161acafa11c32ff992d125337c640727997cb55","url":"/docs/18/sspi-auth.html"},{"label":"PostgreSQL 18 English manual","path":"auth-pg-hba-conf.html","sha256":"6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9","url":"/docs/18/auth-pg-hba-conf.html"}]},"MeasuredEvidence":{}},"Text":{"Collection":"auth","Key":"sspi","SourceDatabase":"center","Version":"18","Locale":"en","Title":"sspi","Summary":"Use SSPI to authenticate the user. This is only available on Windows. See Section 20.7 for details.","BodyHTML":"\u003cdiv id=\"SSPI-AUTH\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2\u003e20.7. SSPI Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003e\u003cspan\u003eSSPI\u003c/span\u003e is a \u003cspan\u003eWindows\u003c/span\u003e technology for secure authentication with single sign-on. \u003cspan\u003ePostgreSQL\u003c/span\u003e will use SSPI in \u003ccode\u003enegotiate\u003c/code\u003e mode, which will use \u003cspan\u003eKerberos\u003c/span\u003e when possible and automatically fall back to \u003cspan\u003eNTLM\u003c/span\u003e in other cases. \u003cspan\u003eSSPI\u003c/span\u003e and \u003cspan\u003eGSSAPI\u003c/span\u003e interoperate as clients and servers, e.g., an \u003cspan\u003eSSPI\u003c/span\u003e client can authenticate to an \u003cspan\u003eGSSAPI\u003c/span\u003e server. It is recommended to use \u003cspan\u003eSSPI\u003c/span\u003e on Windows clients and servers and \u003cspan\u003eGSSAPI\u003c/span\u003e on non-Windows platforms.\u003c/p\u003e\n\u003cp\u003eWhen using \u003cspan\u003eKerberos\u003c/span\u003e authentication, \u003cspan\u003eSSPI\u003c/span\u003e works the same way \u003cspan\u003eGSSAPI\u003c/span\u003e does; see \u003ca href=\"/docs/18/gssapi-auth.html\" rel=\"nofollow\"\u003eSection 20.6\u003c/a\u003e for details.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for \u003cspan\u003eSSPI\u003c/span\u003e:\u003c/p\u003e\n\u003cdiv\u003e\n\u003cdl\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003einclude_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf set to 0, the realm name from the authenticated user principal is stripped off before being passed through the user name mapping (\u003ca href=\"/docs/18/auth-username-maps.html\" rel=\"nofollow\"\u003eSection 20.2\u003c/a\u003e). This is discouraged and is primarily available for backwards compatibility, as it is not secure in multi-realm environments unless \u003ccode\u003ekrb_realm\u003c/code\u003e is also used. It is recommended to leave \u003ccode\u003einclude_realm\u003c/code\u003e set to the default (1) and to provide an explicit mapping in \u003ccode\u003epg_ident.conf\u003c/code\u003e to convert principal names to \u003cspan\u003ePostgreSQL\u003c/span\u003e user names.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003ecompat_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf set to 1, the domain\u0026#39;s SAM-compatible name (also known as the NetBIOS name) is used for the \u003ccode\u003einclude_realm\u003c/code\u003e option. This is the default. If set to 0, the true realm name from the Kerberos user principal name is used.\u003c/p\u003e\n\u003cp\u003eDo not disable this option unless your server runs under a domain account (this includes virtual service accounts on a domain member system) and all clients authenticating through SSPI are also using domain accounts, or authentication will fail.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eupn_username\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf this option is enabled along with \u003ccode\u003ecompat_realm\u003c/code\u003e, the user name from the Kerberos UPN is used for authentication. If it is disabled (the default), the SAM-compatible user name is used. By default, these two names are identical for new user accounts.\u003c/p\u003e\n\u003cp\u003eNote that \u003cspan\u003elibpq\u003c/span\u003e uses the SAM-compatible name if no explicit user name is specified. If you use \u003cspan\u003elibpq\u003c/span\u003e or a driver based on it, you should leave this option disabled or explicitly specify user name in the connection string.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003emap\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAllows for mapping between system and database user names. See \u003ca href=\"/docs/18/auth-username-maps.html\" rel=\"nofollow\"\u003eSection 20.2\u003c/a\u003e for details. For an SSPI/Kerberos principal, such as \u003ccode\u003eusername@EXAMPLE.COM\u003c/code\u003e (or, less commonly, \u003ccode\u003eusername/hostbased@EXAMPLE.COM\u003c/code\u003e), the user name used for mapping is \u003ccode\u003eusername@EXAMPLE.COM\u003c/code\u003e (or \u003ccode\u003eusername/hostbased@EXAMPLE.COM\u003c/code\u003e, respectively), unless \u003ccode\u003einclude_realm\u003c/code\u003e has been set to 0, in which case \u003ccode\u003eusername\u003c/code\u003e (or \u003ccode\u003eusername/hostbased\u003c/code\u003e) is what is seen as the system user name when mapping.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003ekrb_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eSets the realm to match user principal names against. If this parameter is set, only users of that realm will be accepted. If it is not set, users of any realm can connect, subject to whatever user name mapping is done.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003c/div\u003e","SourceRevision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","ContentHash":"cc663997ef2f03348d18e8fe11a395a53f1ab72509d0c44085204251f25489f3","Payload":{"description":["Use SSPI to authenticate the user. This is only available on Windows. See Section 20.7 for details."],"manual_html":"\u003cdiv class=\"sect1\" id=\"SSPI-AUTH\"\u003e\n\u003cdiv class=\"titlepage\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2 class=\"title\"\u003e20.7. SSPI Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003e\u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e is a \u003cspan class=\"productname\"\u003eWindows\u003c/span\u003e technology for secure authentication with single sign-on. \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e will use SSPI in \u003ccode class=\"literal\"\u003enegotiate\u003c/code\u003e mode, which will use \u003cspan class=\"productname\"\u003eKerberos\u003c/span\u003e when possible and automatically fall back to \u003cspan class=\"productname\"\u003eNTLM\u003c/span\u003e in other cases. \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e and \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e interoperate as clients and servers, e.g., an \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e client can authenticate to an \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e server. It is recommended to use \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e on Windows clients and servers and \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e on non-Windows platforms.\u003c/p\u003e\n\u003cp\u003eWhen using \u003cspan class=\"productname\"\u003eKerberos\u003c/span\u003e authentication, \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e works the same way \u003cspan class=\"productname\"\u003eGSSAPI\u003c/span\u003e does; see \u003ca class=\"xref\" href=\"/docs/18/gssapi-auth.html\" title=\"20.6. GSSAPI Authentication\"\u003eSection 20.6\u003c/a\u003e for details.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for \u003cspan class=\"productname\"\u003eSSPI\u003c/span\u003e:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf set to 0, the realm name from the authenticated user principal is stripped off before being passed through the user name mapping (\u003ca class=\"xref\" href=\"/docs/18/auth-username-maps.html\" title=\"20.2. User Name Maps\"\u003eSection 20.2\u003c/a\u003e). This is discouraged and is primarily available for backwards compatibility, as it is not secure in multi-realm environments unless \u003ccode class=\"literal\"\u003ekrb_realm\u003c/code\u003e is also used. It is recommended to leave \u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e set to the default (1) and to provide an explicit mapping in \u003ccode class=\"filename\"\u003epg_ident.conf\u003c/code\u003e to convert principal names to \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e user names.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003ecompat_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf set to 1, the domain's SAM-compatible name (also known as the NetBIOS name) is used for the \u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e option. This is the default. If set to 0, the true realm name from the Kerberos user principal name is used.\u003c/p\u003e\n\u003cp\u003eDo not disable this option unless your server runs under a domain account (this includes virtual service accounts on a domain member system) and all clients authenticating through SSPI are also using domain accounts, or authentication will fail.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eupn_username\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eIf this option is enabled along with \u003ccode class=\"literal\"\u003ecompat_realm\u003c/code\u003e, the user name from the Kerberos UPN is used for authentication. If it is disabled (the default), the SAM-compatible user name is used. By default, these two names are identical for new user accounts.\u003c/p\u003e\n\u003cp\u003eNote that \u003cspan class=\"application\"\u003elibpq\u003c/span\u003e uses the SAM-compatible name if no explicit user name is specified. If you use \u003cspan class=\"application\"\u003elibpq\u003c/span\u003e or a driver based on it, you should leave this option disabled or explicitly specify user name in the connection string.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003emap\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAllows for mapping between system and database user names. See \u003ca class=\"xref\" href=\"/docs/18/auth-username-maps.html\" title=\"20.2. User Name Maps\"\u003eSection 20.2\u003c/a\u003e for details. For an SSPI/Kerberos principal, such as \u003ccode class=\"literal\"\u003eusername@EXAMPLE.COM\u003c/code\u003e (or, less commonly, \u003ccode class=\"literal\"\u003eusername/hostbased@EXAMPLE.COM\u003c/code\u003e), the user name used for mapping is \u003ccode class=\"literal\"\u003eusername@EXAMPLE.COM\u003c/code\u003e (or \u003ccode class=\"literal\"\u003eusername/hostbased@EXAMPLE.COM\u003c/code\u003e, respectively), unless \u003ccode class=\"literal\"\u003einclude_realm\u003c/code\u003e has been set to 0, in which case \u003ccode class=\"literal\"\u003eusername\u003c/code\u003e (or \u003ccode class=\"literal\"\u003eusername/hostbased\u003c/code\u003e) is what is seen as the system user name when mapping.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003ekrb_realm\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eSets the realm to match user principal names against. If this parameter is set, only users of that realm will be accepted. If it is not set, users of any realm can connect, subject to whatever user name mapping is done.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003c/div\u003e","related":[],"sections":[],"tables":[{"columns":[{"key":"name","label":"Option or term"},{"key":"description","label":"Meaning"}],"key":"method-options","rows":[{"description":"If set to 0, the realm name from the authenticated user principal is stripped off before being passed through the user name mapping ( Section 20.2 ). This is discouraged and is primarily available for backwards compatibility, as it is not secure in multi-realm environments unless krb_realm is also used. It is recommended to leave include_realm set to the default (1) and to provide an explicit mapping in pg_ident.conf to convert principal names to PostgreSQL user names.","name":"include_realm"},{"description":"If set to 1, the domain's SAM-compatible name (also known as the NetBIOS name) is used for the include_realm option. This is the default. If set to 0, the true realm name from the Kerberos user principal name is used. Do not disable this option unless your server runs under a domain account (this includes virtual service accounts on a domain member system) and all clients authenticating through SSPI are also using domain accounts, or authentication will fail.","name":"compat_realm"},{"description":"If this option is enabled along with compat_realm , the user name from the Kerberos UPN is used for authentication. If it is disabled (the default), the SAM-compatible user name is used. By default, these two names are identical for new user accounts. Note that libpq uses the SAM-compatible name if no explicit user name is specified. If you use libpq or a driver based on it, you should leave this option disabled or explicitly specify user name in the connection string.","name":"upn_username"},{"description":"Allows for mapping between system and database user names. See Section 20.2 for details. For an SSPI/Kerberos principal, such as username@EXAMPLE.COM (or, less commonly, username/hostbased@EXAMPLE.COM ), the user name used for mapping is username@EXAMPLE.COM (or username/hostbased@EXAMPLE.COM , respectively), unless include_realm has been set to 0, in which case username (or username/hostbased ) is what is seen as the system user name when mapping.","name":"map"},{"description":"Sets the realm to match user principal names against. If this parameter is set, only users of that realm will be accepted. If it is not set, users of any realm can connect, subject to whatever user name mapping is done.","name":"krb_realm"}],"title":"Documented method options and alternatives"}]}},"RequestedLocale":"zh-Hans","Fallback":true,"Versions":["10","11","12","13","14","15","16","17","18","19","20"],"Locales":["en"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}