pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Stephen Frost <sfrost@snowman.net>
To: Sehrope Sarkuni <sehrope@jackdb.com>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: Josh Berkus <josh@agliodbs.com>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: WIP: SCRAM authentication
Date: Sun, 9 Aug 2015 17:05:57 -0400
Message-ID: <20150809210557.GI3685@tamriel.snowman.net> (raw)
In-Reply-To: <CAH7T-arqWysXN1F90NqjsmbmKHjYvBSGwkjvJTjWJ6aWFhfOJA@mail.gmail.com>
References: <CAB7nPqRBtLOT=g3q2-uYE=NbBdtkLubvDbV6wfCUp3hubpa6dg@mail.gmail.com>
	<CA+TgmoZ0XxXZeGa0f1uwaCN-FCjFsAJZdJgioeesdhfR7jmEhg@mail.gmail.com>
	<55C4FCC2.3000503@iki.fi>
	<CAB7nPqRWYJmw+qJrawP=h2J5s6LFea3NUb10VJJjdBNr1Wz=+g@mail.gmail.com>
	<CA+TgmoazGS0TpAtrFw+ft1UVUevBBXew5Lo6b1jtozgykpy5PA@mail.gmail.com>
	<55C63B1E.2040101@iki.fi>
	<WM!bb6c003556a9ab74bed5c5a96b8da26b0a7e307b9d3c3626ac9dd949d0b9abdcb49dfe9c7445e6f178be1e5f52c15059!@asav-3.01.com>
	<55C679C7.4060908@agliodbs.com>
	<CAB7nPqS_OdrwXgS6btk9_2xyNPc8fvMjuj1Cg5cLgqCYP1Vbpg@mail.gmail.com>
	<CAH7T-arqWysXN1F90NqjsmbmKHjYvBSGwkjvJTjWJ6aWFhfOJA@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

* Sehrope Sarkuni (sehrope@jackdb.com) wrote:
> It'd be nice if the new auth mechanism supports multiple passwords in the
> same format as well (not just one per format).
> 
> That way you could have two different passwords for a user that are active
> at the same time. This would simplify rolling database credentials as it
> wouldn't have to be done all at once. You could add the new credentials,
> update your app servers one by one, then disable the old ones.
> 
> A lot of systems that use API keys let you see the last time a particular
> set of keys was used. This helps answer the "Is this going to break
> something if I disable it?" question. Having a last used at timestamp for
> each auth mechanism (per user) would be useful.

Excellent points and +1 to all of these ideas from me.

> I'm not sure how updates should work when connecting to a read-only slave
> though. It would need some way of letting the master know that user X
> connected using credentials Y.

That wouldn't be all that hard to add to the protocol..

What would be nice also would be to include slave connections in
pg_stat_activity, so you could figure out what transaction on what slave
is causing your master to bloat...  And then if we could send signals
from the master to those processes, it'd be even nicer..

	Thanks!

		Stephen

Attachments:

  signature.asc (application/pgp-signature, 818B) download

view thread (77+ messages)  latest in thread

Message-ID: <20150809210557.GI3685@tamriel.snowman.net>
Permalink:  ../20150809210557.GI3685@tamriel.snowman.net/
Also on:    postgresql.org/message-id/20150809210557.GI3685@tamriel.snowman.net

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: sfrost@snowman.net, sehrope@jackdb.com, michael.paquier@gmail.com, josh@agliodbs.com, hlinnaka@iki.fi, robertmhaas@gmail.com
  Subject: Re: WIP: SCRAM authentication
  In-Reply-To: <20150809210557.GI3685@tamriel.snowman.net>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox