pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robbie Harwood <rharwood@redhat.com>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Cc: Stephen Frost <sfrost@snowman.net>
Subject: Re: [PATCH v12] GSSAPI encryption support
Date: Tue, 26 Jul 2016 11:29:08 -0400
Message-ID: <18337.1469546948@sss.pgh.pa.us> (raw)
In-Reply-To: <jlg7fc8fmq7.fsf@thriss.redhat.com>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
	<jlgy48ssyvl.fsf@thriss.redhat.com>
	<20160406112105.GG10850@tamriel.snowman.net>
	<jlg1t6isftk.fsf@thriss.redhat.com>
	<1530.1459977031@sss.pgh.pa.us>
	<jlgy48qqt86.fsf@thriss.redhat.com>
	<5486.1459984857@sss.pgh.pa.us>
	<CAB7nPqRPK1f4oAStwsy_Ty_Cjjo8U50HF0bRZi86my7va4nVdg@mail.gmail.com>
	<jlgk2hq3uvr.fsf@thriss.redhat.com>
	<jlg7fc91lko.fsf@thriss.redhat.com>
	<CAB7nPqSmq1tuVGoVQXVb86y9SoaM-wcMDxHD1of9dGc54QYNSQ@mail.gmail.com>
	<jlg7fc8fmq7.fsf@thriss.redhat.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

Robbie Harwood <rharwood@redhat.com> writes:
> So there's a connection setting `sslmode` that we'll want something
> similar to here (`gssapimode` or so).  `sslmode` has six settings, but I
> think we only need three for GSSAPI: "disable", "allow", and "prefer"
> (which presumably would be the default).

FWIW, there is quite a bit of unhappiness around sslmode=prefer, see
for example this thread:
https://www.postgresql.org/message-id/flat/2A5EFBDC-41C6-42A8-8B6D-E69DA60E9962%40eggerapps.at

I do not know if we can come up with a better answer, but I'd caution
you against thinking that that's a problem-free model to emulate.

			regards, tom lane


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (220+ messages)  latest in thread

Message-ID: <18337.1469546948@sss.pgh.pa.us>
Permalink:  ../18337.1469546948@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/18337.1469546948@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, rharwood@redhat.com, michael.paquier@gmail.com, sfrost@snowman.net
  Subject: Re: [PATCH v12] GSSAPI encryption support
  In-Reply-To: <18337.1469546948@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox