Date: Mon, 25 Mar 2013 11:17:52 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Tim Watts <tim.j.watts@kcl.ac.uk>
Cc: Tom Lane <tgl@sss.pgh.pa.us>,
	"pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
Subject: Re: Postgresql 8.4 GSSAPI auth with fallback to password
 prompting?
Message-ID: <20130325151751.GN4361@tamriel.snowman.net>
References: <514AFB73.6050300@kcl.ac.uk>
	<5c910ac4f9fa4dc78f1ba6747182b671@DBXPRD0310HT003.eurprd03.prod.outlook.com>
	<51502949.6000903@kcl.ac.uk>
	<20130325132557.GM4361@tamriel.snowman.net>
	<8661258abad94cca91cc7bd4d3d84b26@DBXPRD0310HT002.eurprd03.prod.outlook.com>
	<5150659E.8070401@kcl.ac.uk>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="BVqADUpb46OwFRC+"
Content-Disposition: inline
In-Reply-To: <5150659E.8070401@kcl.ac.uk>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org


--BVqADUpb46OwFRC+
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Tim,

* Tim Watts (tim.j.watts@kcl.ac.uk) wrote:
> I presume the protocol does not allow the server to send a succession of
> "Type: Authentication request" packets with different Authentication
> types until it deems that one is acceptable?

Even if it did, existing clients would very likely be confused by it..

To be honest, I don't have a solution in mind for how to make this
happen, I was really just pointing out that there's a difference between
"we won't do that because we don't trust the sysadmin" and "that's not
an option due to how the system works today".  Perhaps one option would
be to look at the Negotiate protocol which mod_auth_kerb and friends use
and perhaps have that as an explicitly new auth mechanism.  A server set
up to provide that would, of course, have to consider if its users
supported it or not but that's true already- you can have situation
already though, a given client might not support gssapi, for example.

	Thanks,

		Stephen

--BVqADUpb46OwFRC+
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlFQap8ACgkQrzgMPqB3kih3EQCfftUqfsUTNZZrydT1f2D93eU0
1K0AoIeUzf3rjQl/zABsXIQ6zmCrFrUg
=/3Kl
-----END PGP SIGNATURE-----

--BVqADUpb46OwFRC+--