From: Tim Watts <tim.j.watts@kcl.ac.uk>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: pgsql-admin@postgresql.org <pgsql-admin@postgresql.org>
Subject: Re: Postgresql 8.4 GSSAPI auth with fallback to password prompting?
Date: Mon, 25 Mar 2013 14:56:30 +0000
Message-ID: <5150659E.8070401@kcl.ac.uk> (raw)
In-Reply-To: <8661258abad94cca91cc7bd4d3d84b26@DBXPRD0310HT002.eurprd03.prod.outlook.com>
References: <514AFB73.6050300@kcl.ac.uk>
<5c910ac4f9fa4dc78f1ba6747182b671@DBXPRD0310HT003.eurprd03.prod.outlook.com>
<51502949.6000903@kcl.ac.uk>
<20130325132557.GM4361@tamriel.snowman.net>
<8661258abad94cca91cc7bd4d3d84b26@DBXPRD0310HT002.eurprd03.prod.outlook.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
On 25/03/13 14:31, Tom Lane wrote:
> Stephen Frost <sfrost@snowman.net> writes:
>> * Tim Watts (tim.j.watts@kcl.ac.uk) wrote:
>>> I would have to respectfully take another point of view: that that
>>> particular judgement is probably better placed with the sysadmin
>>> rather than a blanket decision by the devs.
>
>> It's not a blanket decision by any means- the current situation is that
>> such an option doesn't exist. It's not "it exists, but we disabled it
>> because we felt like it."
>
>> Were someone to write the code to support such an option, it's entirely
>> possible it'd get committed (though likely with strong caveats about its
>> use in the documentation).
>
> I'm not sure it would. Allowing a fallback would amount to a protocol
> change, meaning that old clients might fail in strange ways. You'd
> need a lot stronger case than has been made here to justify dealing
> with that.
>
Just had a look at a non SSL psql connection with wireshark:
The username is offered. Then the server comes back with:
"Type: Authentication request"
"Authentication type: Plaintext password (3)"
So clearly it's not as simple as the client offering what it feels like.
And whilst I assume it might be possible for the server to have a new
code for
"Authentication type: GSSAPI with Password-Interactive-Fallback"
that's not going to be implicitly backwardly compatible.
Tricky I agree...
I presume the protocol does not allow the server to send a succession of
"Type: Authentication request" packets with different Authentication
types until it deems that one is acceptable?
BTW - I am not seriously proposing this - just for a bit of idea banter
and better understanding by me. If you've all got better things to do,
ignore me :-o
Cheers,
Tim
--
Tim Watts Tel (VOIP): +44 (0)1580 848360
Systems Manager Digital Humanities, King's College London
Systems Messages and Notifications: https://systemsblog.cch.kcl.ac.uk/
Personal Blog: http://squiddy.blog.dionic.net/
"A fanatic is one who can't change his mind and won't change the subject."
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tim.j.watts@kcl.ac.uk, tgl@sss.pgh.pa.us, sfrost@snowman.net
Subject: Re: Postgresql 8.4 GSSAPI auth with fallback to password prompting?
In-Reply-To: <5150659E.8070401@kcl.ac.uk>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox