From: Tim Watts <tim.j.watts@kcl.ac.uk>
To: Stephen Frost <sfrost@snowman.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-admin@postgresql.org <pgsql-admin@postgresql.org>
Subject: Re: Postgresql 8.4 GSSAPI auth with fallback to password prompting?
Date: Mon, 25 Mar 2013 15:30:05 +0000
Message-ID: <51506D7D.5090105@kcl.ac.uk> (raw)
In-Reply-To: <fba1bf2b8f1f46b8b7334ac9cb32b957@DBXPRD0310HT002.eurprd03.prod.outlook.com>
References: <514AFB73.6050300@kcl.ac.uk>
<5c910ac4f9fa4dc78f1ba6747182b671@DBXPRD0310HT003.eurprd03.prod.outlook.com>
<51502949.6000903@kcl.ac.uk>
<20130325132557.GM4361@tamriel.snowman.net>
<8661258abad94cca91cc7bd4d3d84b26@DBXPRD0310HT002.eurprd03.prod.outlook.com>
<5150659E.8070401@kcl.ac.uk>
<fba1bf2b8f1f46b8b7334ac9cb32b957@DBXPRD0310HT002.eurprd03.prod.outlook.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
On 25/03/13 15:17, Stephen Frost wrote:
> Tim,
>
> * Tim Watts (tim.j.watts@kcl.ac.uk) wrote:
>> I presume the protocol does not allow the server to send a succession of
>> "Type: Authentication request" packets with different Authentication
>> types until it deems that one is acceptable?
>
> Even if it did, existing clients would very likely be confused by it..
>
> To be honest, I don't have a solution in mind for how to make this
> happen, I was really just pointing out that there's a difference between
> "we won't do that because we don't trust the sysadmin" and "that's not
> an option due to how the system works today".
No no - fully understood :)
I appreciate the candid and reasoned arguments :)
I wish I could help - but I more of a sysamdin and less of a developer.
But it is *very* helpful to know that something *is not possible* and
*is likely to not be possible for a long time, if ever*. That allows me
as a humble user of the software to plan deployment :)
> Perhaps one option would
> be to look at the Negotiate protocol which mod_auth_kerb and friends use
> and perhaps have that as an explicitly new auth mechanism. A server set
> up to provide that would, of course, have to consider if its users
> supported it or not but that's true already- you can have situation
> already though, a given client might not support gssapi, for example.
A "negotiate" option would be very cool. I will expect nothing (on the
basis it's free software, I have no rights ;-> ).
Save to say I think Postgresql is very cool already and has been for the
last 12 years I've been using it...
All the best,
Tim
--
Tim Watts Tel (VOIP): +44 (0)1580 848360
Systems Manager Digital Humanities, King's College London
Systems Messages and Notifications: https://systemsblog.cch.kcl.ac.uk/
Personal Blog: http://squiddy.blog.dionic.net/
"She got her looks from her father. He's a plastic surgeon."
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tim.j.watts@kcl.ac.uk, sfrost@snowman.net, tgl@sss.pgh.pa.us
Subject: Re: Postgresql 8.4 GSSAPI auth with fallback to password prompting?
In-Reply-To: <51506D7D.5090105@kcl.ac.uk>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox