Date: Fri, 16 Dec 2016 20:23:22 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	Heikki Linnakangas <hlinnaka@iki.fi>,
	Robert Haas <robertmhaas@gmail.com>,
	Andres Freund <andres@anarazel.de>,
	David Steele <david@pgmasters.net>, Tom Lane <tgl@sss.pgh.pa.us>,
	David Fetter <david@fetter.org>,
	Alvaro Herrera <alvherre@2ndquadrant.com>,
	Magnus Hagander <magnus@hagander.net>,
	Julian Markwort <julian.markwort@uni-muenster.de>,
	PostgreSQL mailing lists <pgsql-hackers@postgresql.org>,
	Valery Popov <v.popov@postgrespro.ru>
Subject: Re: pg_authid.rolpassword format (was Re: Password
 identifiers, protocol aging and SCRAM protocol)
Message-ID: <20161217012322.GO18360@tamriel.snowman.net>
References: 
 <CAB7nPqTi5jC_AbVMOGidrVy1z6t3v==vWFvdNMxnQEN-WsutKg@mail.gmail.com>
 <2d07165c-1793-e243-a2a9-e45b624c7580@iki.fi>
 <CAB7nPqQ28o6ocOdbidOVmxxcKDMP=woZ=hvAVHKKAjAUtjZNyQ@mail.gmail.com>
 <ce051da1-cc5a-2a06-a9a8-6a4d0d98bdd1@2ndquadrant.com>
 <20161214145723.GJ23417@tamriel.snowman.net>
 <9dc32483-b24a-5832-53e0-fb62838f1315@iki.fi>
 <20161215134030.GI23417@tamriel.snowman.net>
 <7a3e9184-9fca-3593-ffe2-729d15df32a6@2ndquadrant.com>
 <20161216204244.GL18360@tamriel.snowman.net>
 <CAB7nPqT76L=bei3aGDEnOogUnGkHyM7TDnxbC-ndCAFv16vtcA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="LpcCHpaCAbC4X43d"
Content-Disposition: inline
In-Reply-To: 
 <CAB7nPqT76L=bei3aGDEnOogUnGkHyM7TDnxbC-ndCAFv16vtcA@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--LpcCHpaCAbC4X43d
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Michael,

* Michael Paquier (michael.paquier@gmail.com) wrote:
> On Sat, Dec 17, 2016 at 5:42 AM, Stephen Frost <sfrost@snowman.net> wrote:
> > * Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> >> On 12/15/16 8:40 AM, Stephen Frost wrote:
> >> > I don't follow why we can't change the syntax for CREATE USER to all=
ow
> >> > specifying the verifier type independently.
> >>
> >> That's what the last patch set I looked at actually does.
> >
> > Well, same here, but it was quite a while ago and things have progressed
> > since then wrt SCRAM, as I understand it...
>=20
> From the discussions of last year on -hackers, it was decided to *not*
> have an additional column per complains from a couple of hackers

It seems that, at best, we didn't have consensus on it.  Hopefully we
are moving in a direction of consensus.

> (Robert you were in this set at this point), and the same thing was
> concluded during the informal lunch meeting at PGcon. The point is,
> the existing SCRAM patch set can survive without touching at *all* the
> format of pg_authid. We could block SCRAM authentication when
> "password" is used in pg_hba.conf and as well as when "scram" is used
> with a plain password stored in pg_authid. Or look at the format of
> the string in the catalog if "password" is defined and decide the
> authentication protocol to follow based on that.

As I mentioned up-thread, moving forward with minimal changes to get
SCRAM in certainly makes sense, but I do think we should be open to
(and, ideally, encouraging people to work towards) having a seperate
table for verifiers with independent columns for type and verifier.

Thanks!

Stephen

--LpcCHpaCAbC4X43d
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJYVJOKAAoJEO1sijiDR2RVdjYQAJGRk85sl9sV1BzPsug1WAeu
SbTXFXF3RQgfZFpqAEVHxGvx0Jv9cFAZisebN/Hv97LodYQX5V0vE4B9Z59G6kyQ
kYO5cyZL6pnkaIJWqVfRX08DDiZq3DlyTmm7S5Oc/OXVr1fm1rSuFbtAsx4Gq/LG
geDqdJ/SNSnN/FubRQKsF01KfFuHthpI84ZZn81TZmXBTZxS6WYpCOUuQTlKo7Z1
08tSGIs6qn86Plxf+8r58/hGz7+2o8MYOzjHDqAerA7d465P5VQLv/T588kgH1dz
GFw2ewfU90JrNUFpLvDQaGLkQZarbOn73WctJLDLsFiYdmd3MxHfTR9z/Pe3kLzV
OHbOSQ6MUcmWhptfPfrFN/JzMxK5ctkCx+2hi1MjmYyM5L+G8M8OpCgRX+4TaCir
PI+R1XdzmtXraVpjVENcL78Qk3m++P3U4SS9vrIBI2ugWHYzxEj249PALYtgtc4h
TG1tmWfwxGlk+bG/HPl5n2HW2xyJM9ZxpSYqGQPsrFJBZmlH+kYX2QcPVZNkjBkN
QIRoZVK6P1HzGo2ZYnTgZou0bzwBUaax/lBxkKQTFH0rL7cxJTiKtAiVBHbE4Bcp
arOw4LD+25NFWhcaZ04UmUWkG3J1Z3YRmTepXn8Ukbtd/jn9aJCt082awL1XUEBg
xkBfjDScR5RMMcPFL0Ob
=g929
-----END PGP SIGNATURE-----

--LpcCHpaCAbC4X43d--