Date: Wed, 14 Dec 2016 09:57:23 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Michael Paquier <michael.paquier@gmail.com>,
	Heikki Linnakangas <hlinnaka@iki.fi>,
	Robert Haas <robertmhaas@gmail.com>,
	Andres Freund <andres@anarazel.de>,
	David Steele <david@pgmasters.net>, Tom Lane <tgl@sss.pgh.pa.us>,
	David Fetter <david@fetter.org>,
	Alvaro Herrera <alvherre@2ndquadrant.com>,
	Magnus Hagander <magnus@hagander.net>,
	Julian Markwort <julian.markwort@uni-muenster.de>,
	PostgreSQL mailing lists <pgsql-hackers@postgresql.org>,
	Valery Popov <v.popov@postgrespro.ru>
Subject: Re: pg_authid.rolpassword format (was Re: Password
 identifiers, protocol aging and SCRAM protocol)
Message-ID: <20161214145723.GJ23417@tamriel.snowman.net>
References: <e139fcbc-cfb2-3a64-93ac-afd5ba342960@iki.fi>
 <CAB7nPqSqEwRgmVCS_OW3sJn6baymQ6MsO3kKMRvHLC0RZaKaYA@mail.gmail.com>
 <21eecdb8-365b-8347-1ae2-5278d1fe798c@iki.fi>
 <CAB7nPqT2UGWm0ukdomC+mG-co6nmKer62vuSGRxwtc+jS8uQPA@mail.gmail.com>
 <CAB7nPqQtD7jOpYCsB4Ga=Cz+tgh4Ngac6NAV-WLs9zxaw0Uu7w@mail.gmail.com>
 <762f4875-a87e-cf0b-c06b-b357294d8be1@iki.fi>
 <CAB7nPqTi5jC_AbVMOGidrVy1z6t3v==vWFvdNMxnQEN-WsutKg@mail.gmail.com>
 <2d07165c-1793-e243-a2a9-e45b624c7580@iki.fi>
 <CAB7nPqQ28o6ocOdbidOVmxxcKDMP=woZ=hvAVHKKAjAUtjZNyQ@mail.gmail.com>
 <ce051da1-cc5a-2a06-a9a8-6a4d0d98bdd1@2ndquadrant.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="e890kymSckUvwzhr"
Content-Disposition: inline
In-Reply-To: <ce051da1-cc5a-2a06-a9a8-6a4d0d98bdd1@2ndquadrant.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--e890kymSckUvwzhr
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> On 12/14/16 5:15 AM, Michael Paquier wrote:
> > I would be tempted to suggest adding the verifier type as a new column
> > of pg_authid
>=20
> Yes please.

This discussion seems to continue to come up and I don't entirely
understand why we keep trying to shove more things into pg_authid, or
worse, into rolpassword.

We should have an independent table for the verifiers, which has a
different column for the verifier type, and either starts off supporting
multiple verifiers per role or at least gives us the ability to add that
easily later.  We should also move rolvaliduntil to that new table.

No, I am specifically *not* concerned with "backwards compatibility" of
that table- we continually add to it and change it and applications
which are so closely tied to PG that they look at pg_authid need to be
updated with nearly every release anyway.  What we *do* need to make
sure we get correct is what pg_dump/pg_upgrade do, but that's entirely
within our control to manage and shouldn't be that much of an issue to
implement.

Thanks!

Stephen

--e890kymSckUvwzhr
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJYUV3TAAoJEO1sijiDR2RVgBUQAJg5DWbGjevpi8CYikKZl7vl
5BTfqu+4kQqi0/YMlWoDBZl4oY2XlbflhzdeMjXcbd3DcCdtIFm4XiJPC219jKFM
cI437sK5fr43iuRHXWWOuCy02cE9xtkqUNu7dKgoUxWLmagE28vW1neSZWSQjqj5
nkLt565OWZRIjYQkR235ddJLVbFvPj8zqPppY3Cy4jDfbFhwGNw0ye/3XUM54XnL
SovBqh6jTc+Y/+CEzV8RJQd659ULgvB/pdjui4qAowe5Ybo7Geo/zFfhfRhNofxS
rWPcpe7fdTu8viKk4lHHApZpL49f/yQiBVXOiDoymocQ1PLcOFP0wAGHDmIwCbVs
1SiS5hwoOujSbP5Tw+4eLRX9v+MOneC89i40EMtGfiGAxmUFPiFuRL+jMk7TBxGO
4LGjzh7y8ooXoEkn75yvIQdfoS24gXraR5GzyOBTAk5aVERHU7AOkMx2u0yPjIed
y9nM9bgk4NK/d/YJ/kQaE8VOIcse3j012e8ySeRTSoo0snsOb6yTRqQ1PR2UW5Lj
R+QoNC1Fs0h58fdC8mxZzgrAoqJRByYG+hplvuZkPdyPmvU+729vV68ZL7XrvNR+
tqq0k4jAOKrZtyNNIUnS73nyMic7cw4ks65eomhpsuHZ7Z7PG/vSjDuYFGrMbYAl
DNA9NScMrZ+yF5qhlXS9
=uTei
-----END PGP SIGNATURE-----

--e890kymSckUvwzhr--