Parameter · Connections and Authentication / Authentication
gss_accept_delegation
Sets whether GSSAPI delegation should be accepted from the client.
- Default:
off - Type: bool
- Applies: Reload
In plain words
With Kerberos, a client can hand over ("delegate") its credentials so the server can act on the user's behalf, for example when postgres_fdw or dblink connects to another server as that same user. This switch lets the server accept those credentials. Off by default.
For DBAs and operators
Added in PostgreSQL 16. When on, and the client requests delegation (libpq gssdelegation=1), the forwarded Kerberos credentials are stored for the backend's lifetime. postgres_fdw and dblink can then authenticate to a remote server with GSSAPI as the original user, without stored passwords. Whether credentials were delegated is visible in pg_stat_gssapi.credentials_delegated.
Security: a delegated credential lets the server (and code running in it) impersonate the user to other Kerberos services until the ticket expires. Enable it only on servers you trust for that, and only where fdw/dblink with GSSAPI is actually needed. Non-superusers using postgres_fdw must authenticate to the remote server with a password or delegated GSSAPI credentials; delegation is how that requirement is met without passwords.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().