Date: Sun, 9 Aug 2015 17:05:57 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Sehrope Sarkuni <sehrope@jackdb.com>
Cc: Michael Paquier <michael.paquier@gmail.com>,
 Josh Berkus <josh@agliodbs.com>, Heikki Linnakangas <hlinnaka@iki.fi>,
 Robert Haas <robertmhaas@gmail.com>,
 pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: WIP: SCRAM authentication
Message-ID: <20150809210557.GI3685@tamriel.snowman.net>
References: 
 <CAB7nPqRBtLOT=g3q2-uYE=NbBdtkLubvDbV6wfCUp3hubpa6dg@mail.gmail.com>
 <CA+TgmoZ0XxXZeGa0f1uwaCN-FCjFsAJZdJgioeesdhfR7jmEhg@mail.gmail.com>
 <55C4FCC2.3000503@iki.fi>
 <CAB7nPqRWYJmw+qJrawP=h2J5s6LFea3NUb10VJJjdBNr1Wz=+g@mail.gmail.com>
 <CA+TgmoazGS0TpAtrFw+ft1UVUevBBXew5Lo6b1jtozgykpy5PA@mail.gmail.com>
 <55C63B1E.2040101@iki.fi>
 <WM!bb6c003556a9ab74bed5c5a96b8da26b0a7e307b9d3c3626ac9dd949d0b9abdcb49dfe9c7445e6f178be1e5f52c15059!@asav-3.01.com>
 <55C679C7.4060908@agliodbs.com>
 <CAB7nPqS_OdrwXgS6btk9_2xyNPc8fvMjuj1Cg5cLgqCYP1Vbpg@mail.gmail.com>
 <CAH7T-arqWysXN1F90NqjsmbmKHjYvBSGwkjvJTjWJ6aWFhfOJA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="LQAwcd5tHl0Qlnzi"
Content-Disposition: inline
In-Reply-To: 
 <CAH7T-arqWysXN1F90NqjsmbmKHjYvBSGwkjvJTjWJ6aWFhfOJA@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--LQAwcd5tHl0Qlnzi
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Sehrope Sarkuni (sehrope@jackdb.com) wrote:
> It'd be nice if the new auth mechanism supports multiple passwords in the
> same format as well (not just one per format).
>=20
> That way you could have two different passwords for a user that are active
> at the same time. This would simplify rolling database credentials as it
> wouldn't have to be done all at once. You could add the new credentials,
> update your app servers one by one, then disable the old ones.
>=20
> A lot of systems that use API keys let you see the last time a particular
> set of keys was used. This helps answer the "Is this going to break
> something if I disable it?" question. Having a last used at timestamp for
> each auth mechanism (per user) would be useful.

Excellent points and +1 to all of these ideas from me.

> I'm not sure how updates should work when connecting to a read-only slave
> though. It would need some way of letting the master know that user X
> connected using credentials Y.

That wouldn't be all that hard to add to the protocol..

What would be nice also would be to include slave connections in
pg_stat_activity, so you could figure out what transaction on what slave
is causing your master to bloat...  And then if we could send signals
=66rom the master to those processes, it'd be even nicer..

	Thanks!

		Stephen

--LQAwcd5tHl0Qlnzi
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVx8C1AAoJEO1sijiDR2RV+1QQAJL4cuxRhQzNtVIeYL5BHUba
6X6+uJNAlkqk26Zp/9dxawnv5bj1uuJRMezq19XnUvm2MDqhk+rQWLnq1QIlyKeo
wJjuYmv6YPhiRR+4pFpXaWc/7AUNBMWsLhDYPUgs6EbYa/tvjpadSRjLfbVwZof+
e7TeEyLwnTp1d/EXtXQSoA8HXshNwn7pKSWNM08NGBd54EYxaA8I3CHJlZFwipSj
S7S7V4tjGg9fXX0FXuEfFBhXCYJVF2Y4pYHSaxFXjsxJVCNWIaM/g1K8ABYgl07r
BU5KTFadmwU0mxgadOGGHhbqQKklNj68ZWkFOhjA4iKg575lB3Ne96YfqzZb0G9a
sr5bmO3k3LUTtyWJ+/zfmABURI5veBT1JoFrwntkOSj/+sNWEKx/F30hUTsnloxj
Qeov/7d4z8gN0VJdG0q67ZKcOFN2oAiKcFrRxNmLZWZHepXJu9uXgOWxA9Ey3lN8
H9tJRKYUpeOnMEhfCDu0AxmHUpPJYrQkpq4S7W+gK3yvQYmJTOGYFHBTOHlbnT2n
Cyr2CTlVCHlf3usQ76xL6ib2RCb648vVT/VE1Vse+vb1EtQITVAXfRGFE2dVl2lW
zbJGdMl/64BoL2yBgx073JXyCu1oleS60t9G72XWqycXiewJMiDQNr/+KDiq1aiH
LKQyqtl+512xfFjx8zF+
=FcJj
-----END PGP SIGNATURE-----

--LQAwcd5tHl0Qlnzi--