Parameter · Connections and Authentication / Authentication
krb_caseins_users
Sets whether Kerberos and GSSAPI user names should be treated as case-insensitive.
- Default:
off - Type: bool
- Applies: Reload
In plain words
Kerberos principals like Alice@EXAMPLE.COM often differ in upper/lower case from PostgreSQL role names like alice. With this setting on, the comparison ignores case.
For DBAs and operators
Off by default: the authenticated GSSAPI name must match the requested role name exactly (after realm stripping when include_realm=0 is set on the HBA line, or after a pg_ident.conf mapping). When it does not match, the log shows LOG: provided user name (alice) and authenticated user name (Alice) do not match and the client gets FATAL: GSSAPI authentication failed for user "alice".
Turning it on is the quick fix for Active Directory environments where principals are mixed-case. A pg_ident.conf map with a regular expression (e.g. /^(.*)@EXAMPLE\.COM$) is more flexible and explicit, and usually preferred. Note that with the default include_realm=1 the realm part is still compared, so most setups need a map anyway.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().