Subject: Re: Proposal: Support custom authentication methods using hooks

From: Jeff Davis <[email-masked]>
Date: Fri, 25 Feb 2022 09:33:45 -0800

On Thu, 2022-02-24 at 20:47 -0500, Tom Lane wrote:
> ... and, since we can't readily enforce that the client only sends
> those cleartext passwords over suitably-encrypted connections, this
> could easily be a net negative for security.  Not sure that I think
> it's a good idea.

I don't understand your point. Can't you just use "hostssl" rather than
"host"?

Also there are some useful cases that don't really require SSL, like
when the client and host are on the same machine, or if you have a
network secured some other way.

Regards,
	Jeff Davis

---

From: Andres Freund <[email-masked]>
Date: Fri, 25 Feb 2022 09:40:53 -0800

Hi,

> I don't understand your point. Can't you just use "hostssl" rather than

And the extension could check Port->ssl_in_use before sendAuthRequest(AUTH_REQ_PASSWORD)
if it wanted to restrict it.

Greetings,

Andres Freund