gss_accept_delegation — PostgreSQL configuration parameter

Sets whether GSSAPI delegation should be accepted from the client.

At a glance

What it does

Sets whether GSSAPI delegation should be accepted from the client. The default is off meaning credentials from the client will not be accepted. Changing this to on will make the server accept credentials delegated to it from the client. This parameter can only be set in the postgresql.conf file or on the server command line.

(Description quoted from the official PostgreSQL documentation.)

How to apply a change

Set it in postgresql.conf (or with ALTER SYSTEM) and reload with SELECT pg_reload_conf(); or pg_ctl reload — no restart needed.

Inspect the current value and source with SHOW gss_accept_delegation; or SELECT name, setting, unit, context, source FROM pg_settings WHERE name = 'gss_accept_delegation';.

Tuning guidance

This is a connectivity or security setting, not a performance knob. Choose the value from your security and network requirements (TLS files, ciphers, keepalives, authentication behaviour) rather than for throughput, and verify it against your organization’s policy. Test changes in staging, because a wrong value here can lock clients out.

Reference

PostgreSQL documentation — gss_accept_delegation.