pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Bruce Momjian <bruce@momjian.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Greg Stark <stark@mit.edu>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: Josh Berkus <josh@agliodbs.com>
Cc: Peter Eisentraut <peter_e@gmx.net>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: WIP: SCRAM authentication
Date: Fri, 4 Sep 2015 20:31:47 -0400
Message-ID: <20150905003147.GD21484@momjian.us> (raw)
In-Reply-To: <20150904205133.GB3685@tamriel.snowman.net>
References: <20150813013607.GS3685@tamriel.snowman.net>
	<WM!f47f2028fc1867e14926553022b78cd909807c8421cfe79fc83dece946e5dacb3c67bbaa75c363e878fc83c4680f7899!@asav-1.01.com>
	<55CCE12B.4030306@agliodbs.com>
	<20150818140637.GI3685@tamriel.snowman.net>
	<CA+TgmoacqxJSojswVDXE_rC_44woWiAXNizEzHTjqF_x_zJs_Q@mail.gmail.com>
	<20150818180730.GT3685@tamriel.snowman.net>
	<CA+TgmobP92kt+1acn1pdY0Kx-9xcaAWdhqOmu2yq216T0-2dJA@mail.gmail.com>
	<CAM-w4HOZh8U7QyT92o1oLEpEwyLmafbZHVmCCBTVGFnmOD2pwA@mail.gmail.com>
	<20150904194819.GE26916@momjian.us>
	<20150904205133.GB3685@tamriel.snowman.net>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

On Fri, Sep  4, 2015 at 04:51:33PM -0400, Stephen Frost wrote:
> > Coming in late, but can you explain how multiple passwords allow for
> > easier automated credential rotation?  If you have five applications
> > with stored passwords, I imagine you can't change them all at once, so
> > with multiples you could change it on one, then go to the others and
> > change it there, and finally, remove the old password.  Is that the
> > process?  I am not realizing that without multiple plasswords, this is a
> > hard problem.
> 
> That's exactly the process if multiple passwords can be used.  If
> there's only one account and one password supported then you have to
> change all the systems all at once and that certainly can be a hard
> problem.
> 
> One way to deal with this is to have a bunch of different accounts, but
> that's certainly not simple either and can get quite painful.

OK, for me, if we can explain the benefit for users, it seems worth
doing just to allow that.

-- 
  Bruce Momjian  <bruce@momjian.us>        http://momjian.us
  EnterpriseDB                             http://enterprisedb.com

  + Everyone has their own god. +


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (77+ messages)  latest in thread

Message-ID: <20150905003147.GD21484@momjian.us>
Permalink:  ../20150905003147.GD21484@momjian.us/
Also on:    postgresql.org/message-id/20150905003147.GD21484@momjian.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: bruce@momjian.us, sfrost@snowman.net, stark@mit.edu, robertmhaas@gmail.com, josh@agliodbs.com, peter_e@gmx.net, hlinnaka@iki.fi, michael.paquier@gmail.com
  Subject: Re: WIP: SCRAM authentication
  In-Reply-To: <20150905003147.GD21484@momjian.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox