Date: Thu, 19 Jan 2017 01:32:45 -0500
From: Noah Misch <noah@leadboat.com>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: Victor Wagner <vitus@wagner.pp.ru>,
	PostgreSQL mailing lists <pgsql-hackers@postgresql.org>,
	peter.eisentraut@2ndquadrant.com
Subject: Re: Password identifiers, protocol aging and SCRAM protocol
Message-ID: <20170119063245.GA633066@tornado.leadboat.com>
References: 
 <CAB7nPqRy3krN8quR9XujMVVHYtXJ0_60nqgVc6oUk8ygyVkZsA@mail.gmail.com>
 <4f3a9e71-cb1b-ca44-a780-36d503671e45@iki.fi>
 <CAB7nPqRW5JvH8jj+zNjBL72EYDyj3qPdNGYWvuHNq9-BR63R_w@mail.gmail.com>
 <d60f8ddb-3ba5-2402-8951-7ae23ba0974b@iki.fi>
 <CAB7nPqQpek5pUUinmZNMr+n9+vgaUqaxZJ9zWRoMKM8e1uHRHw@mail.gmail.com>
 <CAB7nPqTxH8Nnvo0ii4w6881cT3OODgJcE7RFk-WaS+mYD-7pyg@mail.gmail.com>
 <20161109091309.6437a8b3@fafnir.local.vm>
 <CAB7nPqRsiwYOiOB+raZBqckh4obLBZgX43EkaGVomVVFpwH6DA@mail.gmail.com>
 <20170118052356.GA5952@gust>
 <CAB7nPqQa3QzhP7QNL6ykN5WQkyf1WQ36vuus=71zFEs5gpYKHg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: 
 <CAB7nPqQa3QzhP7QNL6ykN5WQkyf1WQ36vuus=71zFEs5gpYKHg@mail.gmail.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On Wed, Jan 18, 2017 at 02:30:38PM +0900, Michael Paquier wrote:
> On Wed, Jan 18, 2017 at 2:23 PM, Noah Misch <noah@leadboat.com> wrote:
> > The latest versions document this precisely, but I agree with Peter's concern
> > about plain "scram".  Suppose it's 2025 and PostgreSQL support SASL mechanisms
> > OAUTHBEARER, SCRAM-SHA-256, SCRAM-SHA-256-PLUS, and SCRAM-SHA3-512.  What
> > should the pg_hba.conf options look like at that time?  I don't think having a
> > single "scram" option fits in such a world.
> 
> Sure.
> 
> > I see two strategies that fit:
> >
> > 1. Single "sasl" option, with a GUC, similar to ssl_ciphers, controlling the
> >    mechanisms to offer.
> > 2. Separate options "scram_sha_256", "scram_sha3_512", "oauthbearer", etc.
> 
> Or we could have a sasl option, with a mandatory array of mechanisms
> to define one or more items, so method entries in pg_hba.conf would
> look llke that:
> sasl mechanism=scram_sha_256,scram_sha3_512

I like that.


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers