Date: Fri, 25 Feb 2022 11:49:02 -0800
From: Andres Freund <andres@anarazel.de>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jeff Davis <pgsql@j-davis.com>, samay sharma <smilingsamay@gmail.com>,
	pgsql-hackers@lists.postgresql.org
Subject: Re: Proposal: Support custom authentication methods using hooks
Message-ID: <20220225194902.zeuku7srobumnbsy@alap3.anarazel.de>
References: <CAJxrbyxTRn5P8J-p+wHLwFahK5y56PhK28VOb55jqMO05Y-DJw@mail.gmail.com>
 <bfc55e8045453659df26cd60035bfbb4b9530052.camel@j-davis.com>
 <1737574.1645753674@sss.pgh.pa.us>
 <54dc198b56a87e31e9625405383f04a8c6589b8b.camel@j-davis.com>
 <1905579.1645810764@sss.pgh.pa.us>
 <2718414dc095b716e59e126c03af343997d14c7b.camel@j-davis.com>
 <1980351.1645816239@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1980351.1645816239@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/20220225194902.zeuku7srobumnbsy%40alap3.anarazel.de>
Precedence: bulk

Hi,

On 2022-02-25 14:10:39 -0500, Tom Lane wrote:
> I'm happy to add support for custom auth methods if they can use
> a protocol that's safer than cleartext-password.  But if that's the
> only feasible option, then we're just encouraging people to use
> insecure methods.

It looks like scram can be used without much trouble. All the necessary
infrastructure to implement it without duplication appears to be public.  The
plugin would need to get a secret from whereever and call
  CheckSASLAuth(&pg_be_scram_mech, port, shadow_pass, logdetail);

or if it needs to do something more complicated than CheckSASLAuth(), it can
use AUTH_REQ_SASL{,_FIN CONT} itself.

Of course whether it's viable depends on what the custom auth method wants to
do. But it's not a restriction of the authentication plugin model.

Greetings,

Andres Freund