From: Stephen Frost <sfrost@snowman.net>
To: Michael Paquier <michael@paquier.xyz>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jonathan S. Katz <jkatz@postgresql.org>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
Date: Tue, 23 Apr 2019 10:43:06 -0400
Message-ID: <20190423144306.GQ6197@tamriel.snowman.net> (raw)
In-Reply-To: <20190423000619.GD2712@paquier.xyz>
References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org>
<4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org>
<20190422015051.GA3433@paquier.xyz>
<3033.1555940554@sss.pgh.pa.us>
<20190422135215.GG6197@tamriel.snowman.net>
<20190423000619.GD2712@paquier.xyz>
Greetings,
* Michael Paquier (michael@paquier.xyz) wrote:
> On Mon, Apr 22, 2019 at 09:52:15AM -0400, Stephen Frost wrote:
> > I recall having exactly that debate when SCRAM was being worked on and
> > the push-back basically being that it was more work and we'd have to
> > have additional syntax for ALTER USER, et al. I wish I had had more
> > time to spend on that discussion. Water under the bridge now, but
> > hopefully we learn from this and maybe someone refactors how this works
> > sometime soon (or, at least, whenever we add the next password
> > encoding).
>
> I am not sure that this would have been more work for ALTER TABLE as
> we could have relied on just password_encryption to do the work as we
> do now. The reluctance was to have more additional columns in
> pg_authid as far as I recall, and I sided with having a separate
> catalog, and more independent verifier type checks in the catalogs, as
> you may recall, which would have also eased password rollups for a
> given role.
Yes, having an indepedent catalog table would have been a good approach
too, much better than where we're at now. I hope someone has time to
work on that for a future version.
Thanks!
Stephen
Attachments:
[application/pgp-signature] signature.asc (818B, ../20190423144306.GQ6197@tamriel.snowman.net/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: sfrost@snowman.net, michael@paquier.xyz, tgl@sss.pgh.pa.us, jkatz@postgresql.org, pgsql-bugs@lists.postgresql.org
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
In-Reply-To: <20190423144306.GQ6197@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox