Date: Fri, 4 Sep 2015 20:31:47 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Greg Stark <stark@mit.edu>, Robert Haas <robertmhaas@gmail.com>,
 Josh Berkus <josh@agliodbs.com>, Peter Eisentraut <peter_e@gmx.net>,
 Heikki Linnakangas <hlinnaka@iki.fi>,
 Michael Paquier <michael.paquier@gmail.com>,
 pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: WIP: SCRAM authentication
Message-ID: <20150905003147.GD21484@momjian.us>
References: <20150813013607.GS3685@tamriel.snowman.net>
 <WM!f47f2028fc1867e14926553022b78cd909807c8421cfe79fc83dece946e5dacb3c67bbaa75c363e878fc83c4680f7899!@asav-1.01.com>
 <55CCE12B.4030306@agliodbs.com>
 <20150818140637.GI3685@tamriel.snowman.net>
 <CA+TgmoacqxJSojswVDXE_rC_44woWiAXNizEzHTjqF_x_zJs_Q@mail.gmail.com>
 <20150818180730.GT3685@tamriel.snowman.net>
 <CA+TgmobP92kt+1acn1pdY0Kx-9xcaAWdhqOmu2yq216T0-2dJA@mail.gmail.com>
 <CAM-w4HOZh8U7QyT92o1oLEpEwyLmafbZHVmCCBTVGFnmOD2pwA@mail.gmail.com>
 <20150904194819.GE26916@momjian.us>
 <20150904205133.GB3685@tamriel.snowman.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20150904205133.GB3685@tamriel.snowman.net>
User-Agent: Mutt/1.5.20 (2009-06-14)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On Fri, Sep  4, 2015 at 04:51:33PM -0400, Stephen Frost wrote:
> > Coming in late, but can you explain how multiple passwords allow for
> > easier automated credential rotation?  If you have five applications
> > with stored passwords, I imagine you can't change them all at once, so
> > with multiples you could change it on one, then go to the others and
> > change it there, and finally, remove the old password.  Is that the
> > process?  I am not realizing that without multiple plasswords, this is a
> > hard problem.
> 
> That's exactly the process if multiple passwords can be used.  If
> there's only one account and one password supported then you have to
> change all the systems all at once and that certainly can be a hard
> problem.
> 
> One way to deal with this is to have a bunch of different accounts, but
> that's certainly not simple either and can get quite painful.

OK, for me, if we can explain the benefit for users, it seems worth
doing just to allow that.

-- 
  Bruce Momjian  <bruce@momjian.us>        http://momjian.us
  EnterpriseDB                             http://enterprisedb.com

  + Everyone has their own god. +


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers