From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jacob Champion <pchampion@vmware.com>
cc: "michael@paquier.xyz" <michael@paquier.xyz>,
        "pgsql-committers@lists.postgresql.org"
 <pgsql-committers@lists.postgresql.org>
Subject: Re: pgsql: Add some information about authenticated identity via
 log_connec
In-reply-to: <fa8dbbb58c20b1d1adf0082769f80d5466eaf485.camel@vmware.com>
References: <E1lTwp4-0002l4-L9@gemulon.postgresql.org>
 <YG05nCI8x8B+Ad3G@paquier.xyz> <1544704.1617805663@sss.pgh.pa.us>
 <fa8dbbb58c20b1d1adf0082769f80d5466eaf485.camel@vmware.com>
Comments: In-reply-to Jacob Champion <pchampion@vmware.com>
	message dated "Wed, 07 Apr 2021 16:20:18 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1597945.1617814317.1@sss.pgh.pa.us>
Date: Wed, 07 Apr 2021 12:51:57 -0400
Message-ID: <1597946.1617814317@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1597946.1617814317%40sss.pgh.pa.us>
Precedence: bulk

Jacob Champion <pchampion@vmware.com> writes:
> On Wed, 2021-04-07 at 10:27 -0400, Tom Lane wrote:
>> prairiedog is also not happy, apparently for a different reason.

> That one's failing because older OpenSSL doesn't support channel
> binding, and the new test I wrote forgot to check to make sure channel
> binding was supported... sorry.
> But the test doesn't truly *need* channel binding anyway; it just needs
> to check the interaction between SCRAM and verify-full, to ensure that
> the correct authn_id is set. Patch attached, tested locally with
> OpenSSL 1.0.1 and 1.1.1.

Sounds reasonable, pushed.  (I didn't actually verify it on prairiedog,
because that would have taken a couple hours :-(.  We can revisit if
that animal fails to go green.)

			regards, tom lane