search

MagicStack / asyncpg

A fast PostgreSQL Database Client Library for Python/asyncio.
Apache License 2.0
6.88k stars 399 forks source link

Don't attempt to canonicalize peer name in Kerberos/GSSAPI/SSPI auth #1166

Closed elprans closed 2 months ago

elprans commented 2 months ago

libpq does not canonicalize and neither should we, because:

1) it's likely the wrong thing to do and removes control from the user; 2) it introduces a blocking DNS lookup into an async path, which is not great.

eltoder commented 2 months ago

Unfortunately, this does not work:

gssapi.raw.misc.GSSError: Major (851968): Unspecified GSS failure.  Minor code may provide more information, Minor (2529638919): Server not found in Kerberos database

But we can make the code follow libpq more closely and remove the gethostbyname_ex call. I'll send a PR.

eltoder commented 2 months ago

1167