From: Michael Paquier <michael@paquier.xyz>
To: Jeff Davis <pgsql@j-davis.com>
Cc: pgsql-hackers@postgresql.org
Subject: Re: Add "password_protocol" connection parameter to libpq
Date: Fri, 9 Aug 2019 12:00:21 +0900
Message-ID: <20190809030021.GG3194@paquier.xyz> (raw)
In-Reply-To: <227015d8417f2b4fef03f8966dbfa5cbcc4f44da.camel@j-davis.com>
References: <227015d8417f2b4fef03f8966dbfa5cbcc4f44da.camel@j-davis.com>
On Thu, Aug 08, 2019 at 03:38:20PM -0700, Jeff Davis wrote:
> Libpq doesn't have a way to control which password protocols are used.
> For example, the client might expect the server to be using SCRAM, but
> it actually ends up using plain password authentication instead.
Thanks for working on this!
> I'm not 100% happy with the name "password_protocol", but other names I
> could think of seemed likely to cause confusion.
What about auth_protocol then? It seems to me that it could be useful
to have the restriction on AUTH_REQ_MD5 as well.
> Sets the least-secure password protocol allowable when using password
> authentication. Options are: "plaintext", "md5", "scram-sha-256", or
> "scram-sha-256-plus".
This makes it sound like there is a linear hierarchy among all those
protocols, which is true in this case, but if the list of supported
protocols is extended in the future it may be not.
I think that this should have TAP tests in src/test/authentication/ so
as we make sure of the semantics. For the channel-binding part, the
logic path for the test would be src/test/ssl.
+#define DefaultPasswordProtocol "plaintext"
I think that we are going to need another default value for that, like
"all" to reduce the confusion that SCRAM, MD5 and co are still
included in the authorized set in this case.
Another thing that was discussed on the topic would be to allow a list
of authorized protocols instead. I personally don't think that we
need to go necessarily this way, but it could make the integration of
things line scram-sha-256,scram-sha-256-plus easier to integrate in
application flows.
--
Michael
Attachments:
[application/pgp-signature] signature.asc (832B, ../20190809030021.GG3194@paquier.xyz/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: michael@paquier.xyz, pgsql@j-davis.com
Subject: Re: Add "password_protocol" connection parameter to libpq
In-Reply-To: <20190809030021.GG3194@paquier.xyz>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox