Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pjT5w-0003Jq-LF for pgsql-hackers@arkaria.postgresql.org; Mon, 03 Apr 2023 22:56:12 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1pjT5u-0001xe-8z for pgsql-hackers@arkaria.postgresql.org; Mon, 03 Apr 2023 22:56:10 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pjT5t-0001xT-Tv for pgsql-hackers@lists.postgresql.org; Mon, 03 Apr 2023 22:56:09 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1pjT5p-000iOf-BY for pgsql-hackers@lists.postgresql.org; Mon, 03 Apr 2023 22:56:09 +0000 Received: from coridan.postgresql.org ([2001:4800:3e1:1::213]) by mahout.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pjT5n-0003q0-FG for pgsql-hackers@lists.postgresql.org; Mon, 03 Apr 2023 22:56:03 +0000 Received: from localhost ([127.0.0.1] helo=coridan.postgresql.org) by coridan.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1pjT5m-002iTX-TV for pgsql-hackers@lists.postgresql.org; Mon, 03 Apr 2023 22:56:02 +0000 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: Re: Kerberos delegation support in libpq and postgres_fdw To: pgsql-hackers@lists.postgresql.org From: David Christensen Cc: Stephen Frost Date: Mon, 03 Apr 2023 22:55:30 +0000 User-Agent: pgcommitfest X-cfsender: davidchristensen In-Reply-To: References: Message-ID: <168056253038.1140.16967636521311876451.pgcf@coridan.postgresql.org> List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk VGhlIGZvbGxvd2luZyByZXZpZXcgaGFzIGJlZW4gcG9zdGVkIHRocm91Z2ggdGhlIGNvbW1pdGZl c3QgYXBwbGljYXRpb246Cm1ha2UgaW5zdGFsbGNoZWNrLXdvcmxkOiAgdGVzdGVkLCBwYXNzZWQK SW1wbGVtZW50cyBmZWF0dXJlOiAgICAgICB0ZXN0ZWQsIHBhc3NlZApTcGVjIGNvbXBsaWFudDog ICAgICAgICAgIG5vdCB0ZXN0ZWQKRG9jdW1lbnRhdGlvbjogICAgICAgICAgICBub3QgdGVzdGVk CgpEaWQgYSBjb2RlIHJldmlldyBwYXNzIGhlcmU7IGhlcmUgaXMgc29tZSBmZWVkYmFjay4NCg0K DQorCS8qIElmIHBhc3N3b3JkIHdhcyB1c2VkIHRvIGNvbm5lY3QsIG1ha2Ugc3VyZSBpdCB3YXMg b25lIHByb3ZpZGVkICovDQorCWlmIChQUWNvbm5lY3Rpb25Vc2VkUGFzc3dvcmQoY29ubikgJiYg ZGJsaW5rX2Nvbm5zdHJfaGFzX3B3KGNvbm5zdHIpKQ0KKwkJcmV0dXJuOw0KDQogIERvIHdlIG5l ZWQgdG8gY29uc2lkZXIgd2hldGhlciB0aGVzZSBwYXNzd29yZHMgYXJlIHRoZSBzYW1lPyAgSXMg dGhlcmUgYSBkaWZmZXJlbnQgdmVjdG9yIHdoZXJlIGEgZGlmZmVyZW50IHBhc3N3b3JkIGNvdWxk IGJlIGFjcXVpcmVkIGZyb20gYSBkaWZmZXJlbnQgc291cmNlIChQR1BBU1NXT1JELCBzYXkpIHdo aWxlIGJvdGggb2YgdGhlc2UgY3JpdGVyaWEgYXJlIHRydWU/ICBTZWVtcyBsaWtlIGl0IHByb2Jh Ymx5IGRvZXNuJ3QgbWF0dGVyIHRoYXQgbXVjaCBjb25zaWRlcmluZyB3ZSBvbmx5IGNoZWNrZWQg UGFzc3dvcmQgYWxvbmUgaW4gcHJldmlvdXMgdmVyc2lvbiBvZiB0aGlzIGNvZGUuDQoNCi0tLQ0K DQpMb29rcyBsaWtlIHRoZSBwZ19nc3NpbmZvIHN0cnVjdCBoaWRlcyB0aGUgYHByb3h5X2NyZWRz YCBkZWYgYmVoaW5kOg0KDQogICAgI2lmIGRlZmluZWQoRU5BQkxFX0dTUykgfCBkZWZpbmVkKEVO QUJMRV9TU1BJKQ0KICAgIHR5cGVkZWYgc3RydWN0DQogICAgew0KICAgICAgICBnc3NfYnVmZmVy X2Rlc2Mgb3V0YnVmOwkJLyogR1NTQVBJIG91dHB1dCB0b2tlbiBidWZmZXIgKi8NCiAgICAjaWZk ZWYgRU5BQkxFX0dTUw0KICAgIC4uLg0KICAgICAgICBib29sCQlwcm94eV9jcmVkczsJLyogR1NT QVBJIERlbGVnYXRlZC9wcm94eSBjcmVkZW50aWFscyAqLw0KICAgICNlbmRpZg0KICAgIH0gcGdf Z3NzaW5mbzsNCiAgICAjZW5kaWYNCg0KV2hpY2ggbWVhbnMgdGhhdCB0aGUgbGF0ZXIgY2hlY2sg aW4gYGJlX2dzc2FwaV9nZXRfcHJveHkoKWAgd2UgaGF2ZToNCg0KICAgIC8qDQogICAgICogUmV0 dXJuIGlmIEdTU0FQSSBkZWxlZ2F0ZWQvcHJveHkgY3JlZGVudGlhbHMgd2VyZSBpbmNsdWRlZCBv biB0aGlzDQogICAgICogY29ubmVjdGlvbi4NCiAgICAgKi8NCiAgICBib29sDQogICAgYmVfZ3Nz YXBpX2dldF9wcm94eShQb3J0ICpwb3J0KQ0KICAgIHsNCiAgICAgICAgaWYgKCFwb3J0IHx8ICFw b3J0LT5nc3MpDQogICAgICAgICAgICByZXR1cm4gTlVMTDsNCg0KICAgICAgICByZXR1cm4gcG9y dC0+Z3NzLT5wcm94eV9jcmVkczsNCiAgICB9DQoNClNvIGluIHRoZW9yeSBpdCdkIGJlIHBvc3Np YmxlIHRvIGhhdmUgU1NQSSBlbmFibGVkIGJ1dCBHU1MgZGlzYWJsZWQgYW5kIHdlJ2QgZmFpbCB0 byBjb21waWxlIGluIHRoYXQgY2FzZS4gIChJdCBtYXkgYmUgdGhhdCB0aGlzIHJvdXRpbmUgaXMg bmV2ZXIgKmFjdHVhbGx5KiBjYWxsZWQgaW4gdGhhdCBjYXNlLCBqdXN0IG5vdGluZyBjb21waWxl LXRpbWUgY29uc2lkZXJhdGlvbnMuKSAgSSdtIG5vdCBzZWVpbmcgZ3VhcmRzIGluIHRoZSBhY3R1 YWwgUFEqIHJvdXRpbmVzLCBidXQgZG9uJ3QgdGhpbmsgSSd2ZSBkb25lIGFuIGV4aGF1c3RpdmUg c2VhcmNoLg0KDQotLS0NCg0KZ3NzX2FjY2VwdF9kZWxlZw0KDQoNCisgICAgICAgPHBhcmE+DQor ICAgICAgICBGb3J3YXJkIChkZWxlZ2F0ZSkgR1NTIGNyZWRlbnRpYWxzIHRvIHRoZSBzZXJ2ZXIu ICBUaGUgZGVmYXVsdCBpcw0KKyAgICAgICAgPGxpdGVyYWw+ZGlzYWJsZTwvbGl0ZXJhbD4gd2hp Y2ggbWVhbnMgY3JlZGVudGlhbHMgd2lsbCBub3QgYmUgZm9yd2FyZGVkDQorICAgICAgICB0byB0 aGUgc2VydmVyLiAgU2V0IHRoaXMgdG8gPGxpdGVyYWw+ZW5hYmxlPC9saXRlcmFsPiB0byBoYXZl DQorICAgICAgICBjcmVkZW50aWFscyBmb3J3YXJkZWQgd2hlbiBwb3NzaWJsZS4NCg0KV2hlbiBp cyB0aGlzIG5vdCBwb3NzaWJsZT8gIFNlcnZlciBwb2xpY3k/ICBFeHRlcm5hbCBmYWN0b3JzPw0K DQotLS0NCg0KICAgIDwvcGFyYT4NCiAgICA8cGFyYT4NCiAgICAgT25seSBzdXBlcnVzZXJzIG1h eSBjb25uZWN0IHRvIGZvcmVpZ24gc2VydmVycyB3aXRob3V0IHBhc3N3b3JkDQotICAgIGF1dGhl bnRpY2F0aW9uLCBzbyBhbHdheXMgc3BlY2lmeSB0aGUgPGxpdGVyYWw+cGFzc3dvcmQ8L2xpdGVy YWw+IG9wdGlvbg0KLSAgICBmb3IgdXNlciBtYXBwaW5ncyBiZWxvbmdpbmcgdG8gbm9uLXN1cGVy dXNlcnMuDQorICAgIGF1dGhlbnRpY2F0aW9uIG9yIHVzaW5nIGdzc2FwaSBwcm94aWVkIGNyZWRl bnRpYWxzLCBzbyBzcGVjaWZ5IHRoZQ0KKyAgICA8bGl0ZXJhbD5wYXNzd29yZDwvbGl0ZXJhbD4g b3B0aW9uIGZvciB1c2VyIG1hcHBpbmdzIGJlbG9uZ2luZyB0bw0KKyAgICBub24tc3VwZXJ1c2Vy cyB3aG8gYXJlIG5vdCBhYmxlIHRvIHByb3h5IEdTU0FQSSBjcmVkZW50aWFscy4NCiAgICA8L3Bh cmE+DQogICAgPHBhcmE+DQoNCnMvZ3NzYXBpL0dTU0FQSS87IHRoaXMgaXMga2luZCBvZiBjb25m dXNpbmcsIGFzIHRoaXMgbWFrZXMgaXQgc291bmQgbGlrZSBvbmx5IHN1cGVydXNlciBtYXkgdXNl IEdTU0FQSSBwcm94aWVkIGNyZWRlbnRpYWxzLCB3aGljaCBJIGRpc2JlbGlldmUgdG8gYmUgdHJ1 ZS4gIEFkZGl0aW9uYWxseSwgaXQgc291bmRzIGxpa2UgeW91J3JlIHdhbnRpbmcgdG8gZXhwbGlj aXRseSBtYWludGFpbiBhIGRlbnlsaXN0IGZvciB1c2VycyB0byBub3QgYmUgYWxsb3dlZCBwcm94 eWluZzsgaXMgdGhhdCBjb3JyZWN0Pw0KDQotLS0NCg0KbGlicHEvYXV0aC5jOg0KDQoJCWlmIChw cm94eSAhPSBOVUxMKQ0KCQl7DQoJCQlwZ19zdG9yZV9wcm94eV9jcmVkZW50aWFsKHByb3h5KTsN CgkJCXBvcnQtPmdzcy0+cHJveHlfY3JlZHMgPSB0cnVlOw0KCQl9DQoNClBlciBHU1MgZG9jcywg c2VlbXMgbGlrZSB3ZSBzaG91bGQgYmUgY29tcGFyaW5nIHRvIEdTU19DX05PX0NSRURFTlRJQUwg YW5kIHZhbGlkYXRpbmcgdGhhdCB0aGUgZ2ZsYWdzIGhhcyB0aGUgYGRlbGVnX2ZsYWdgIGJpdCBz ZXQgYmVmb3JlIGNvbnNpZGVyaW5nIHdoZXRoZXIgdGhlcmUgYXJlIHZhbGlkIGNyZWRlbnRpYWxz OyBpbiBwcmFjdGljZSB0aGlzIG1pZ2h0IGJlIHRoZSBzYW1lIGVmZmVjdCAoaGF2ZW4ndCBsb29r ZWQgYXQgd2hhdCB0aGF0IHN5bWJvbCBhY3R1YWxseSByZXNvbHZlcyB0bywgYnV0IE5VTEwgd291 bGQgYmUgc2Vuc2libGUpLg0KDQpBcmUgdGhlcmUgb3RoZXIgY2FzZXMgd2UgbWlnaHQgbmVlZCB0 byBjb25zaWRlciBoZXJlLCBsaWtlIHZhbGlkIGNyZWRlbnRpYWxzLCBidXQgdGhleSBhcmUgZXhw aXJlZD8gKEdTU19TX0NSRURFTlRJQUxTX0VYUElSRUQpDQoNCi0tLQ0KDQorCS8qDQorCSAqIFNl dCBLUkI1Q0NOQU1FIGZvciB0aGlzIGJhY2tlbmQsIHNvIHRoYXQgbGF0ZXIgY2FsbHMgdG8gZ3Nz X2FjcXVpcmVfY3JlZA0KKwkgKiB3aWxsIGZpbmQgdGhlIHByb3hpZWQgY3JlZGVudGlhbHMgd2Ug c3RvcmVkLg0KKwkgKi8NCg0KU28gSSdtIG5vdCBzZWVpbmcgdGhpcyBpbiBvdGhlciB1c2UgaW4g dGhlIGNvZGU7IEkgYXNzdW1lIHRoaXMgaXMganVzdCB1c2VkIGJ5IHRoZSBrcmI1IGxpYnM/DQoN ClNpbWlsYXIgcSdzIGZvciB0aGUgb3RoZXIgcGxhY2VzIHRoZSBwZ19nc3NfYWNjZXB0X2RlbGVn IGFyZSB1c2VkLg0KDQotLS0NCg0KK2ludA0KK1BRY29ubmVjdGlvblVzZWRHU1NBUEkoY29uc3Qg UEdjb25uICpjb25uKQ0KK3sNCisJaWYgKCFjb25uKQ0KKwkJcmV0dXJuIGZhbHNlOw0KKwlpZiAo Y29ubi0+Z3NzYXBpX3VzZWQpDQorCQlyZXR1cm4gdHJ1ZTsNCisJZWxzZQ0KKwkJcmV0dXJuIGZh bHNlOw0KK30NCg0KTWljcm8tZ3JpcGU6IHRoaXMgcm91dGluZSBzZWVtcyBsaWtlIGNvdWxkIGJl IHNpbXBsZXIsIHRob3VnaCB0aGUgY29tcGlsZXIgcHJvYmFibHkgaGFzIHRoZSBzYW1lIHRoaW5n IHRvIHNheSBmb3IgZWl0aGVyLCBzbyBtYXliZSBjb2RlIGNsYXJpdHkgaXMgYmV0dGVyIGFzIHdy aXR0ZW46DQoNCiAgICBpbnQNCiAgICBQUWNvbm5lY3Rpb25Vc2VkR1NTQVBJKGNvbnN0IFBHY29u biAqY29ubikNCiAgICB7DQogICAgICAgIHJldHVybiBjb25uICYmIGNvbm4tPmdzc2FwaV91c2Vk Ow0KICAgIH0NCg0KLS0tDQoNCkFueXRoaW5nIHJlcXVpcmVkIGZvciBhZGRpbmcgbWVzb24gc3Vw cG9ydD8gSSBub3RpY2Ugc3JjL3Rlc3Qva2VyYmVyb3MgaGFzIE1ha2VmaWxlIHVwZGF0ZWQsIGJ1 dCBubyBtZXNvbi5idWlsZCBmaWxlcyBhcmUgY2hhbmdlZC4NCg0KLS0tDQoNClR3byB0ZXN0cyBp biBzcmMvdGVzdC9rZXJiZXJvcy90LzAwMV9hdXRoLnBsIGF0IDo1MzUgYW5kIDo1NDUgaGF2ZSB0 aGUgc2FtZSB0ZXN0IGRlc2NyaXB0aW9uOg0KDQorCSdzdWNjZWVkcyB3aXRoIEdTUy1lbmNyeXB0 ZWQgYWNjZXNzIHJlcXVpcmVkIGFuZCBob3N0Z3NzZW5jIGhiYSBhbmQgY3JlZGVudGlhbHMgbm90 IGZvcndhcmRlZCcsDQoNClNpbmNlIHRoZSBmaXJzdCB0ZXN0IGhhcyBvbmx5IGBnc3NlbmNtb2Rl YCBkZWZpbmVkIChzbyBpbXBsaWNpdCBgZ3NzZGVsZWdgIHZhbHVlKSBhbmQgdGhlIHNlY29uZCBo YXMgYGdzc2RlbGVnPWRpc2FibGVgIEknZCBzdWdnZXN0IHRoYXQgdGhlIHRlc3Qgb24gOjU0NSBz aG91bGQgaGF2ZSBpdHMgZGVzY3JpcHRpb24gdXBkYXRlZCB0byBhZGQgdGhlIHdvcmQgImV4cGxp Y2l0bHkiOg0KDQonc3VjY2VlZHMgd2l0aCBHU1MtZW5jcnlwdGVkIGFjY2VzcyByZXF1aXJlZCBh bmQgaG9zdGdzc2VuYyBoYmEgYW5kIGNyZWRlbnRpYWxzIGV4cGxpY2l0bHkgbm90IGZvcndhcmRl ZCcsDQoNCi0tLQ0KDQpJbiB0aGUgZGJsaW5rIHRlc3QsIHRoaXMgc2VlbXMgbGlrZSBkZWJ1Z2dp bmcganVuazoNCg0KK3ByaW50ICgiJHBzcWxfb3V0Iik7DQorcHJpbnQgKCIkcHNxbF9zdGRlcnIi KTsNCg0KV2hhY2tpbmcgdGhvc2UgbGluZXMgYW5kIHJldmlld2luZyB0aGUgc3Vycm91bmRpbmcg Y29kZSBibG9jazogc28gdGhpcyBpcyB0ZXN0aW5nIHRoYXQgZGJsaW5rIHdvbid0IHVzZSBgLnBn cGFzc2A7IHNvIGlzIHRoaXMgYSBiZWhhdmlvciBjaGFuZ2UsIGFuZCBkYmxpbmsgY291bGQgYmUg cHJldmlvdXNseSB1c2VkIHcvcG9zdGdyZXMgdXNlcidzIC5wZ3Bhc3MgZmlsZT8gIEkgYXNzdW1l IHNpbmNlIHRoaXMgcGF0Y2ggaXMgZm9yYmlkZGluZyB0aGlzLCB3ZSd2ZSBkZWNpZGVkIHRoYXQg dGhhdCBpcyBhIGJhZCBpZGVhLS13YXMgdGhpcyB1cGRhdGVkIGluIHRoZSBkb2NzIHRvIG5vdGUg dGhhdCB0aGlzIGlzIG5vdyBmb3JiaWRkZW4sIG9yIGlzIHRoaXMgc29tZXRoaW5nIHRoYXQgc2hv dWxkIG9ubHkgYXBwbHkgaW4gc29tZSBjYXNlcyAoaS5lLiwgdGhpcyBpcyBub3cgY29uZmlnLXNw ZWNpZmljKT8gIElmIGNvbmZpZy1zcGVjaWZpYywgc2hvdWxkIHdlIGhhdmUgYSB0ZXN0IGluIHRo ZSBub24tZm9yd2FyZGVkIHZlcnNpb24gb2YgdGhlc2UgdGVzdHMgdGhhdCBleGVyY2lzZXMgdGhh dCBiZWhhdmlvcj8NCg0KKyRwc3FsX3JjID0gJG5vZGUtPnBzcWwoDQorICAgICdwb3N0Z3Jlcycs DQorCSJTRUxFQ1QgKiBGUk9NIGRibGluaygndXNlcj10ZXN0MiBkYm5hbWU9JGRibmFtZSBwb3J0 PSRwb3J0IHBhc3NmaWxlPSRwZ3Bhc3MnLCdzZWxlY3QgMScpIGFzIHQxKGMxIGludCk7IiwNCisJ Y29ubnN0ciA9PiAidXNlcj10ZXN0MSBob3N0PSRob3N0IGhvc3RhZGRyPSRob3N0YWRkciBnc3Nl bmNtb2RlPXJlcXVpcmUgZ3NzZGVsZWc9ZGlzYWJsZSIsDQorCXN0ZG91dCA9PiBcJHBzcWxfb3V0 LA0KICANCitpcygkcHNxbF9yYywnMycsJ2RibGluayBkb2VzIG5vdCB3b3JrIHdpdGhvdXQgcHJv eGllZCBjcmVkZW50aWFscyBhbmQgd2l0aCBwYXNzZmlsZScpOw0KK2xpa2UoJHBzcWxfc3RkZXJy LCBxci9wYXNzd29yZCBvciBnc3NhcGkgcHJveGllZCBjcmVkZW50aWFscyByZXF1aXJlZC8sJ2Ri bGluayBkb2VzIG5vdCB3b3JrIHdpdGhvdXQgcHJveGllZCBjcmVkZW50aWFscyBhbmQgd2l0aCBw YXNzZmlsZScpOw0KDQpTYW1lIFEncyBhcHBseSB0byB0aGUgcG9zdGdyZXNfZmR3IHZlcnNpb24g b2YgdGhlc2UgdGVzdHMuDQoNCi0tLQ0KDQo6NjU5IGFuZCA6NjY3LCB0aGUgdGVzdCBkZXNjcmlw dGlvbiBzYXlzIG5vbi1lbmNyeXB0ZWQgYW5kIHRoZSBnc3NlbmNtb2RlPXByZWZlciBpbXBsaWVz IGVuY3J5cHRlZDsgc2VlbXMgbGlrZSB0aG9zZSBkZXNjcmlwdGlvbnMgbWlnaHQgbmVlZCB0byBi ZSB1cGRhdGVkLCBzaW5jZSBpdCBzZWVtcyBsaWtlIHdoYXQgaXQncyByZWFsbHkgdGVzdGluZyBp cyBkYmxpbmsvcG9zdGdyZXNfZmR3IGFnYWluc3QgZ3NzZGVsZWc9ZW5hYmxlZC4gIEFsc28gbG9v a3MgbGlrZSBsYXRlciB0ZXN0cyBhcmUgZXhwbGljaXRseSB0ZXN0aW5nIHcvZ3NzZW5jbW9kZT1y ZXF1aXJlIHNvIG1ha2luZyBtZSB0aGluayB0aGlzIGlzIG1pc2xhYmVsZWQgZnVydGhlci4NCg0K LS0tDQoNClRoaXMgaXMgd2hhdCBJIG5vdGljZWQgb24gYW4gaW5pdGlhbCBwYXNzLXRocm91Z2gu DQoNCkJlc3QsDQoNCkRhdmlkCgpUaGUgbmV3IHN0YXR1cyBvZiB0aGlzIHBhdGNoIGlzOiBXYWl0 aW5nIG9uIEF1dGhvcgo=