pg.ddx.io  pgsql-docs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Stephen Frost <sfrost@snowman.net>
To: Jonathan S. Katz <jkatz@postgresql.org>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Joe Conway <mail@joeconway.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Cc: Noah Misch <noah@leadboat.com>
Subject: Re: initdb recommendations
Date: Fri, 24 May 2019 09:01:23 -0400
Message-ID: <20190524130123.GY2480@tamriel.snowman.net> (raw)
In-Reply-To: <ded009db-b651-1d35-0ec6-282af16068a4@postgresql.org>
References: <9f46f065-ca80-f637-8c5d-a9877bcd5eab@postgresql.org>
	<10093.1558664907@sss.pgh.pa.us>
	<20190524023009.GL2480@tamriel.snowman.net>
	<df011ad3-f1a3-149e-3489-2d68e6ea21a7@joeconway.com>
	<20190524121306.GS2480@tamriel.snowman.net>
	<17041a05-0e28-f2b1-bf0c-fe375af66b45@joeconway.com>
	<20190524121904.GU2480@tamriel.snowman.net>
	<CABUevExV2YKa8cFRmFzf=cGriqhoHqwd9ev=2hWdq1kieqaV6Q@mail.gmail.com>
	<20190524123317.GW2480@tamriel.snowman.net>
	<ded009db-b651-1d35-0ec6-282af16068a4@postgresql.org>

Greetings,

* Jonathan S. Katz (jkatz@postgresql.org) wrote:
> On 5/24/19 8:33 AM, Stephen Frost wrote:
> > We need to provide better documentation about how to get from md5 to
> > SCRAM, in my view.  I'm not sure where that should live, exactly.
> > I really wish we had put more effort into making the migration easy to
> > do over a period of time, and we might actually have to do that before
> > the packagers would be willing to make that change.
> 
> +100...I think we should do this regardless, and I was already thinking
> of writing something up around it. I would even suggest that we have
> said password upgrade documentation backpatched to 10.

Not sure that backpatching is necessary, but I'm not actively against
it.

What I was really getting at though was the ability to have multiple
authenticator tokens active concurrently (eg: md5 AND SCRAM), with an
ability to use either one (idk, md5_or_scram auth method?), and then
automatically set both on password change until everything is using
SCRAM and then remove all MD5 stuff.

Or something along those lines.  In other words, I'm talking about new
development work to ease the migration (while also providing some oft
asked about features, like the ability to do rolling passwords...).

Thanks,

Stephen

Attachments:

  signature.asc (application/pgp-signature, 818B) download

view thread (61+ messages)  latest in thread

Message-ID: <20190524130123.GY2480@tamriel.snowman.net>
Permalink:  ../20190524130123.GY2480@tamriel.snowman.net/
Also on:    postgresql.org/message-id/20190524130123.GY2480@tamriel.snowman.net

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-docs@postgresql.org
  Cc: sfrost@snowman.net, jkatz@postgresql.org, magnus@hagander.net, mail@joeconway.com, tgl@sss.pgh.pa.us, peter.eisentraut@2ndquadrant.com, pgsql-hackers@postgresql.org, noah@leadboat.com
  Subject: Re: initdb recommendations
  In-Reply-To: <20190524130123.GY2480@tamriel.snowman.net>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox