Date: Fri, 24 May 2019 09:01:23 -0400
From: Stephen Frost <sfrost@snowman.net>
To: "Jonathan S. Katz" <jkatz@postgresql.org>
Cc: Magnus Hagander <magnus@hagander.net>, Joe Conway <mail@joeconway.com>,
	Tom Lane <tgl@sss.pgh.pa.us>,
	Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	pgsql-hackers <pgsql-hackers@postgresql.org>,
	Noah Misch <noah@leadboat.com>
Subject: Re: initdb recommendations
Message-ID: <20190524130123.GY2480@tamriel.snowman.net>
References: <9f46f065-ca80-f637-8c5d-a9877bcd5eab@postgresql.org>
 <10093.1558664907@sss.pgh.pa.us>
 <20190524023009.GL2480@tamriel.snowman.net>
 <df011ad3-f1a3-149e-3489-2d68e6ea21a7@joeconway.com>
 <20190524121306.GS2480@tamriel.snowman.net>
 <17041a05-0e28-f2b1-bf0c-fe375af66b45@joeconway.com>
 <20190524121904.GU2480@tamriel.snowman.net>
 <CABUevExV2YKa8cFRmFzf=cGriqhoHqwd9ev=2hWdq1kieqaV6Q@mail.gmail.com>
 <20190524123317.GW2480@tamriel.snowman.net>
 <ded009db-b651-1d35-0ec6-282af16068a4@postgresql.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="9QtXyXGM8HCrXlir"
Content-Disposition: inline
In-Reply-To: <ded009db-b651-1d35-0ec6-282af16068a4@postgresql.org>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--9QtXyXGM8HCrXlir
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Jonathan S. Katz (jkatz@postgresql.org) wrote:
> On 5/24/19 8:33 AM, Stephen Frost wrote:
> > We need to provide better documentation about how to get from md5 to
> > SCRAM, in my view.  I'm not sure where that should live, exactly.
> > I really wish we had put more effort into making the migration easy to
> > do over a period of time, and we might actually have to do that before
> > the packagers would be willing to make that change.
>=20
> +100...I think we should do this regardless, and I was already thinking
> of writing something up around it. I would even suggest that we have
> said password upgrade documentation backpatched to 10.

Not sure that backpatching is necessary, but I'm not actively against
it.

What I was really getting at though was the ability to have multiple
authenticator tokens active concurrently (eg: md5 AND SCRAM), with an
ability to use either one (idk, md5_or_scram auth method?), and then
automatically set both on password change until everything is using
SCRAM and then remove all MD5 stuff.

Or something along those lines.  In other words, I'm talking about new
development work to ease the migration (while also providing some oft
asked about features, like the ability to do rolling passwords...).

Thanks,

Stephen

--9QtXyXGM8HCrXlir
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJc5+sjAAoJEO1sijiDR2RV/7UP/10diayHWShXxWvu9Xi8EdZq
DectAjZeWeTw1bGqo0R7btWR6CJqR2S6eGzs6PR+qCJsJOI+mgjbX8tLXEQfngFq
erDjhfhiabmaE1IyLKPS0uXe8Z/g6V+EXAfpJvX0AMARLIfYSIqT0CGHMmvgMqf+
XWyOAGEUMW7pyrdMOo3J2jnFo7+4HZa8lO81OgazRsTISaeYSB6fcYr23Xgzgn1n
q4T8PYDsmntVkX/3RzJETmKV2bQsS0gzuh0XWqbEQcfxAx9K80zdVD+P/JLFgmqX
IQC9+/HpTEyWyc4ZQCcS0s3eZyJVTWVkoE9BDLJ/2V8bAsTtoWVPsY1naDaQa8Ym
J0jdEKGHJaSyXowb0+Z3JSM11/Yb7LU+Ynzu4fHOFkgwunkbKFnj3B6nkqdqvp2n
k4HW/yJedygNzepHZtW5eQTMNZrxIc9fr5VSfnrHpN/z2sKNapcgxiDcFcqKTLzi
aUAkGxUgbd638cw7gThbA4QbjD4g41u4W4vjPD1YSuMalXE3M0fd4tc1XB4O4R/A
w7hw+seUaKZI+4QI+igR+AHRh2pmMUy3nYpp6QZpCi/Vf7pVOeMcpDCLTXDgVUyy
H0h5NYuMGfj8u00vkf86tjUg/bHk/dVa47Ij/C29FsdaZUx6MOBmiBE3vBEvA8uj
F/dj/kffVqqBGPgCZ9eA
=k4u4
-----END PGP SIGNATURE-----

--9QtXyXGM8HCrXlir--