From: Stephen Frost <sfrost@snowman.net>
To: Robbie Harwood <rharwood@redhat.com>
Cc: Bruce Momjian <bruce@momjian.us>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Joe Conway <mail@joeconway.com>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: David Steele <david@pgmasters.net>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: Nico Williams <nico@cryptonector.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v20] GSSAPI encryption support
Date: Wed, 10 Apr 2019 21:47:01 -0400
Message-ID: <20190411014700.GY6197@tamriel.snowman.net> (raw)
In-Reply-To: <jlg7ec3krmt.fsf@redhat.com>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
<jlgy38mir81.fsf@redhat.com>
<5ec3f734-810e-36e0-030f-af92efe135da@2ndquadrant.com>
<20190223162751.GO6197@tamriel.snowman.net>
<1f799b02-d766-0328-45d6-73e5674d0bc2@2ndquadrant.com>
<CAOuzzgprZ7-gYkzwkPzMOPka62irppKpXNm219q7a_8Fu33TLw@mail.gmail.com>
<500b1be7-d0aa-96a2-9982-d748609faff5@joeconway.com>
<CABUevEyuNNJv=19foa=ycTfTfBUYOEwM8_Uss5OVKrwBAy+Btw@mail.gmail.com>
<20190409153624.t7cozlctjzuf47ja@momjian.us>
<jlg7ec3krmt.fsf@redhat.com>
Greetings,
* Robbie Harwood (rharwood@redhat.com) wrote:
> Bruce Momjian <bruce@momjian.us> writes:
> > On Wed, Apr 3, 2019 at 08:49:25AM +0200, Magnus Hagander wrote:
> >> On Wed, Apr 3, 2019 at 12:22 AM Joe Conway <mail@joeconway.com> wrote:
> >>
> >> Personally I don't find it as confusing as is either, and I find
> >> hostgss to be a good analog of hostssl. On the other hand hostgssenc
> >> is long and unintuitive. So +1 for leaving as is and -1 one for
> >> changing it IMHO.
> >>
> >> I think for those who are well versed in pg_hba (and maybe gss as
> >> well), it's not confusing. That includes me.
> >>
> >> However, for a new user, I can definitely see how it can be
> >> considered confusing. And confusion in *security configuration* is
> >> always a bad idea, even if it's just potential.
> >>
> >> Thus +1 on changing it.
> >>
> >> If it was on the table it might have been better to keep hostgss and
> >> change the authentication method to gssauth or something, but that
> >> ship sailed *years* ago.
> >
> > Uh, did we consider keeping hostgss and changing the auth part at the
> > end to "gssauth"?
>
> I think that was implicitly rejected because we'd have to keep the
> capability to configure "gss" there else break compatibility.
Right, if we changed the name of the auth method then everyone who is
using the "gss" auth method would have to update their pg_hba.conf
files... That would be very ugly. Also, it wasn't implicitly rejected,
it was discussed up-thread (see the comments between Magnus and I,
specifically, quoted above- "that ship sailed *years* ago") and
explicitly rejected.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, rharwood@redhat.com, bruce@momjian.us, magnus@hagander.net, mail@joeconway.com, peter.eisentraut@2ndquadrant.com, alvherre@2ndquadrant.com, david@pgmasters.net, michael@paquier.xyz, nico@cryptonector.com
Subject: Re: [PATCH v20] GSSAPI encryption support
In-Reply-To: <20190411014700.GY6197@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox