Date: Sun, 14 Feb 2016 20:51:10 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Michael Paquier <michael.paquier@gmail.com>,
	David Steele <david@pgmasters.net>,
	Heikki Linnakangas <hlinnaka@iki.fi>,
	Bruce Momjian <bruce@momjian.us>, Greg Stark <stark@mit.edu>,
	Robert Haas <robertmhaas@gmail.com>,
	Josh Berkus <josh@agliodbs.com>, Peter Eisentraut <peter_e@gmx.net>,
	pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: WIP: SCRAM authentication
Message-ID: <20160215015110.GL3331@tamriel.snowman.net>
References: <20150905003147.GD21484@momjian.us>
 <CAB7nPqQutw9kRSmu9Ww5CY2Lpmn_=SWfiqgXDtDoH_jdrS7EgQ@mail.gmail.com>
 <56BE1ECD.3020905@pgmasters.net>
 <CAB7nPqTDD_tnU2Pb3LuFcEB0M8iZxAUzemcegqgztxWk26jL4w@mail.gmail.com>
 <20160215001725.GH3331@tamriel.snowman.net>
 <CAB7nPqQ-p0kiVsLZaDSDW2+pe3voO2R9qu6wgfYWZBJZRDC4Rg@mail.gmail.com>
 <20160215005640.GI3331@tamriel.snowman.net>
 <CAB7nPqQqg3PiU9ZREmTzh3_QSJOah7aUWKzhaJLAxQY_hF6JAQ@mail.gmail.com>
 <20160215012326.GK3331@tamriel.snowman.net>
 <5746.1455500723@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="WpsXmqqNSa2+xZ2i"
Content-Disposition: inline
In-Reply-To: <5746.1455500723@sss.pgh.pa.us>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--WpsXmqqNSa2+xZ2i
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Stephen Frost <sfrost@snowman.net> writes:
> > Why do we need pg_shadow or pg_user or related views at all..?
>=20
> A lot of code looks at those just to get usernames.  I am not in favor of
> breaking such stuff without need.

Alright.

> How about we just say that the password in these old views always reads
> out as '********' even when there is a password, and we invent new views
> that carry real auth information?  (Hopefully in an extensible way.)

I'd be alright with that approach, I'd just rather that any clients
which actually want to read the password field be updated to look at the
extensible and sensible base catalogs, and not some hacked up array that
we shoved into that field.

Thanks!

Stephen

--WpsXmqqNSa2+xZ2i
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWwS8NAAoJEO1sijiDR2RVEUwQALKkzzESzmRX1NRRCwac5KMT
kcMfzNNZW8WEbrvKvUm4vgVaywbQXqtYqXBQ4rsLKia+co88IVeAZl5/qJnER+9n
I2iYzhk98nbrPPB8sEWz2tIZxWYrqx/fdSE+eUYxXcv9aNXMQ2XTgczQXetrBbh+
0/eCwqWY3qP5Nsx00rWvXzfk0R6c06C+DPLdW2AvIxP3KEgg57Dh/0cFcjcGXDkP
6+3Ei9e4tE08tS/N+h0asSjlnqgvg5GDTC5KZALJah4fjlxHyJ7pIaw4H0u0jtIX
b0efgFyhb8RzKu3T/cjSDA75PXzk1PC/GGPeqmewvwrvUk6sdDXKfNH59+FvqAUw
CclLh7uqvNFQvQKmHxB2FzDl8kJtN6DVY/zbSCbGW1cP4cyhM8o2l5g7lSsdpN+4
L9JOzFTihGCUrMUXVnPZP7eysoq3w16RYRADg97h8SYjxuGzv3/wLFMQtf26l07I
9Pj+SPXUKTWB/0uawfPwzAsFZNlajtVTcfFwQntH9kVY0MYF8M3IGFS+8LUEAupR
tciDbrDnz8ekq1IB0uR/dPpkS3qvVSP+4KkEVk4lcpQIm/30i9jbHDsEqK5c2u3C
4TMCM7INLRkqfFEgj59eIn91XFItMGjXuSSWrzLlObwbUeTAlv9qr4FTB3MfddZV
breEJqaEToNcp9PPsI6R
=5xQu
-----END PGP SIGNATURE-----

--WpsXmqqNSa2+xZ2i--