From: Stephen Frost <sfrost@snowman.net>
To: Tim Watts <tim.j.watts@kcl.ac.uk>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-admin@postgresql.org <pgsql-admin@postgresql.org>
Subject: Re: Postgresql 8.4 GSSAPI auth with fallback to password prompting?
Date: Mon, 25 Mar 2013 11:17:52 -0400
Message-ID: <20130325151751.GN4361@tamriel.snowman.net> (raw)
In-Reply-To: <5150659E.8070401@kcl.ac.uk>
References: <514AFB73.6050300@kcl.ac.uk>
<5c910ac4f9fa4dc78f1ba6747182b671@DBXPRD0310HT003.eurprd03.prod.outlook.com>
<51502949.6000903@kcl.ac.uk>
<20130325132557.GM4361@tamriel.snowman.net>
<8661258abad94cca91cc7bd4d3d84b26@DBXPRD0310HT002.eurprd03.prod.outlook.com>
<5150659E.8070401@kcl.ac.uk>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
Tim,
* Tim Watts (tim.j.watts@kcl.ac.uk) wrote:
> I presume the protocol does not allow the server to send a succession of
> "Type: Authentication request" packets with different Authentication
> types until it deems that one is acceptable?
Even if it did, existing clients would very likely be confused by it..
To be honest, I don't have a solution in mind for how to make this
happen, I was really just pointing out that there's a difference between
"we won't do that because we don't trust the sysadmin" and "that's not
an option due to how the system works today". Perhaps one option would
be to look at the Negotiate protocol which mod_auth_kerb and friends use
and perhaps have that as an explicitly new auth mechanism. A server set
up to provide that would, of course, have to consider if its users
supported it or not but that's true already- you can have situation
already though, a given client might not support gssapi, for example.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 197B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, tim.j.watts@kcl.ac.uk, tgl@sss.pgh.pa.us
Subject: Re: Postgresql 8.4 GSSAPI auth with fallback to password prompting?
In-Reply-To: <20130325151751.GN4361@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox