From: Nico Williams <nico@cryptonector.com>
To: Robbie Harwood <rharwood@redhat.com>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v18] GSSAPI encryption support
Date: Mon, 11 Jun 2018 18:00:27 -0500
Message-ID: <20180611230026.GC23356@localhost> (raw)
In-Reply-To: <jlg602phyn5.fsf@redhat.com>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
<jlg1se287n3.fsf@redhat.com>
<jlg602phyn5.fsf@redhat.com>
On Mon, Jun 11, 2018 at 04:11:10PM -0400, Robbie Harwood wrote:
> Nico was kind enough to provide me with some code review. This should
> those concerns (clarify short-read behavior and fixing error checking on
> GSS functions).
Besides the bug you fixed and which I told you about off-list (on IRC,
specifically), I only have some commentary that does not need any
action:
- support for non-Kerberos/default GSS mechanisms
This might require new values for gssmode: prefer-<mechanism-name>
and require-<mechanism-name>. One could always use SPNEGO if there
are multiple mechanisms to choose from. And indeed, you could just
use SPNEGO if the user has credentials for multiple mechanism.
(Because GSS has no standard mechanism _names_, this means making
some up. This is one obnoxious shortcoming of the GSS-API...)
- when the SCRAM channel binding work is done, it might be good to add
an option for TLS + GSS w/ channel binding to TLS and no gss wrap
tokens
Nico
--
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: nico@cryptonector.com, rharwood@redhat.com
Subject: Re: [PATCH v18] GSSAPI encryption support
In-Reply-To: <20180611230026.GC23356@localhost>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox