Date: Sun, 14 Feb 2016 20:23:26 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: David Steele <david@pgmasters.net>,
	Heikki Linnakangas <hlinnaka@iki.fi>,
	Bruce Momjian <bruce@momjian.us>, Greg Stark <stark@mit.edu>,
	Robert Haas <robertmhaas@gmail.com>,
	Josh Berkus <josh@agliodbs.com>, Peter Eisentraut <peter_e@gmx.net>,
	pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: WIP: SCRAM authentication
Message-ID: <20160215012326.GK3331@tamriel.snowman.net>
References: <20150904194819.GE26916@momjian.us>
 <20150904205133.GB3685@tamriel.snowman.net>
 <20150905003147.GD21484@momjian.us>
 <CAB7nPqQutw9kRSmu9Ww5CY2Lpmn_=SWfiqgXDtDoH_jdrS7EgQ@mail.gmail.com>
 <56BE1ECD.3020905@pgmasters.net>
 <CAB7nPqTDD_tnU2Pb3LuFcEB0M8iZxAUzemcegqgztxWk26jL4w@mail.gmail.com>
 <20160215001725.GH3331@tamriel.snowman.net>
 <CAB7nPqQ-p0kiVsLZaDSDW2+pe3voO2R9qu6wgfYWZBJZRDC4Rg@mail.gmail.com>
 <20160215005640.GI3331@tamriel.snowman.net>
 <CAB7nPqQqg3PiU9ZREmTzh3_QSJOah7aUWKzhaJLAxQY_hF6JAQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="SCaOIQf4OfYbUof5"
Content-Disposition: inline
In-Reply-To: 
 <CAB7nPqQqg3PiU9ZREmTzh3_QSJOah7aUWKzhaJLAxQY_hF6JAQ@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--SCaOIQf4OfYbUof5
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Michael,

* Michael Paquier (michael.paquier@gmail.com) wrote:
> It seems to me that applications are going to need a refresh anyway...

Indeed.

> Among the other possibilities I can foresee:
> - Add a column "protocol" to pg_shadow and produce one row per
> protocol, so one user will be listed for all the protocol it has. Any
> application could then filter out things with an additional WHERE
> clause.
> - Nuke passwd from pg_shadow and have a new view pg_shadow_verifiers
> made of the user OID, the protocol and the verifier. This maps quite
> well with pg_auth_verifiers.
> - Give up and nuke pg_shadow, which is here for compatibility down to
> 8.1, and add a protocol column to pg_user, or even better create a new
> view pg_user_verifiers that has all the data of all the protocols. If
> we care a lot about backward-compatibility, pg_user could as well map
> with pg_auth_verifiers with the md5 protocol.
> I would go with the last one.

I would start by pointing out that pg_user currently uses pg_shadow..

Why do we need pg_shadow or pg_user or related views at all..?
Applications will need to be updated, we might as well simply nuke them
and expect applications to use the new catalogs.  Perhaps there is a
useful view or two which we can provide over the new catalogs, but I'd
rather consider how to create brand new, useful, views over the new
catalogs than consider any kind of way to provides backwards
compatible-ish views.

Thanks!

Stephen

--SCaOIQf4OfYbUof5
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWwSiOAAoJEO1sijiDR2RVoCwP/jgiQu/cSl/QzCsoE4SqCMhU
TRMrLJ2PSiWdU2Pv1P1nkmFaERgV2c6Msxq89S9iQ1Ylp2XMqfR0Ry/Gg9dLEA5A
BSNkH08oYKifNfD8Sdkda4lUFgXnoRbHcyAxBb+7fhNc+u1Dz5FVbrb4eL0r6szs
y2EhMcMO1NEWSF+lf6pjScds9mpuhSkoiqcWzb3AEr1eBsGhPmnqGM4XoO2USgdp
wOvEPhlFUlWqVmctlKZgJCWX8124za9UW580jUfHgmCjv8NA+h0zsbSCOXcqWZqN
aP9CflUmjBcN9/Q5cA85gj9f854kZy7NqcLoPbp3928XGucpIiuyWPfYrK42ipv5
Ef5sQ3VpMJF+gACg+Z+oK+VJ+cR5KJUYpFuTWqDm/HmypIl4urWI7+jcq/P3iVFB
3q9YP/h7OgkJU3eHV2h7U9IqB1UUFiEbX3OO320UVzm8/Tb7iOUq4l6ngaVcDyW8
VG9NwJO+Eq8wjD0NHAIqbQTYV2yvGKWewQ+Kcu00PltKdnZsrdmadnPh92QT7abt
Dq+8UdkcUItgnToBxT2BFCARYkoJYZEYWeaB5zDOxMqnQ2jlkU3ZnrysVmbY3/39
riZt0BB+bV8hKNViYsV0NWfmMTSuxyrc0dLgnLZQ1R36NFBstHzsgZFb7fWOVMxr
ZpJ4H36FpIhLamTcMci/
=Ylsi
-----END PGP SIGNATURE-----

--SCaOIQf4OfYbUof5--