Parameter · Connections and Authentication / Authentication
krb_server_keyfile
Sets the location of the Kerberos server key file.
- Default:
FILE:/etc/postgresql-common/krb5.keytab - Type: string
- Applies: Reload
In plain words
For Kerberos/GSSAPI logins (e.g. Active Directory single sign-on) the server needs its own secret key, stored in a "keytab" file. This setting says where that file is.
For DBAs and operators
The keytab must contain the service principal postgres/db1.example.com@EXAMPLE.COM (service name from krb_srvname in the client, default postgres, and the host name the client used). The file must be readable by the server OS user. The value is passed to the Kerberos library as KRB5_KTNAME, so the FILE: prefix is allowed. The build-time default varies: Debian/Ubuntu use FILE:/etc/postgresql-common/krb5.keytab.
Typical failures in the log are a line LOG: accepting GSS security context failed with a DETAIL coming from the Kerberos library (wrong key version, principal not found, clock skew), followed by FATAL: GSSAPI authentication failed for user "alice". Check the file with klist -kt and that the client asks for a ticket for exactly the host name in the keytab (reverse DNS / CNAME problems are the classic cause). Reload is enough to pick up a new path; a rotated keytab at the same path is read on each new connection.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().