From: Jonathan S. Katz <jkatz@postgresql.org>
To: Stephen Frost <sfrost@snowman.net>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Joe Conway <mail@joeconway.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Cc: Noah Misch <noah@leadboat.com>
Subject: Re: initdb recommendations
Date: Fri, 24 May 2019 09:13:42 -0400
Message-ID: <830f9986-9665-b279-a679-787c93d1df51@postgresql.org> (raw)
In-Reply-To: <20190524130123.GY2480@tamriel.snowman.net>
References: <9f46f065-ca80-f637-8c5d-a9877bcd5eab@postgresql.org>
<10093.1558664907@sss.pgh.pa.us>
<20190524023009.GL2480@tamriel.snowman.net>
<df011ad3-f1a3-149e-3489-2d68e6ea21a7@joeconway.com>
<20190524121306.GS2480@tamriel.snowman.net>
<17041a05-0e28-f2b1-bf0c-fe375af66b45@joeconway.com>
<20190524121904.GU2480@tamriel.snowman.net>
<CABUevExV2YKa8cFRmFzf=cGriqhoHqwd9ev=2hWdq1kieqaV6Q@mail.gmail.com>
<20190524123317.GW2480@tamriel.snowman.net>
<ded009db-b651-1d35-0ec6-282af16068a4@postgresql.org>
<20190524130123.GY2480@tamriel.snowman.net>
On 5/24/19 9:01 AM, Stephen Frost wrote:
> Greetings,
>
> * Jonathan S. Katz (jkatz@postgresql.org) wrote:
>> On 5/24/19 8:33 AM, Stephen Frost wrote:
>>> We need to provide better documentation about how to get from md5 to
>>> SCRAM, in my view. I'm not sure where that should live, exactly.
>>> I really wish we had put more effort into making the migration easy to
>>> do over a period of time, and we might actually have to do that before
>>> the packagers would be willing to make that change.
>>
>> +100...I think we should do this regardless, and I was already thinking
>> of writing something up around it. I would even suggest that we have
>> said password upgrade documentation backpatched to 10.
>
> Not sure that backpatching is necessary, but I'm not actively against
> it.
Well, for someone who wants to cut over and has to manually guide the
process, a guide will help in absence of new development.
>
> What I was really getting at though was the ability to have multiple
> authenticator tokens active concurrently (eg: md5 AND SCRAM), with an
> ability to use either one (idk, md5_or_scram auth method?), and then
> automatically set both on password change until everything is using
> SCRAM and then remove all MD5 stuff.
>
> Or something along those lines. In other words, I'm talking about new
> development work to ease the migration (while also providing some oft
> asked about features, like the ability to do rolling passwords...).
Cool, I have been thinking about a similar feature as well to help ease
the transition (and fwiw was going to suggest it in my previous email).
I think an interim step at least is to document how we can at least help
ease the transition.
Thanks,
Jonathan
Attachments:
signature.asc (application/pgp-signature, 832B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: jkatz@postgresql.org, sfrost@snowman.net, magnus@hagander.net, mail@joeconway.com, tgl@sss.pgh.pa.us, peter.eisentraut@2ndquadrant.com, pgsql-hackers@postgresql.org, noah@leadboat.com
Subject: Re: initdb recommendations
In-Reply-To: <830f9986-9665-b279-a679-787c93d1df51@postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox