pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Heikki Linnakangas <hlinnaka@iki.fi>
To: Michael Paquier <michael.paquier@gmail.com>
To: David Steele <david@pgmasters.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: David Fetter <david@fetter.org>
Cc: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Julian Markwort <julian.markwort@uni-muenster.de>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Cc: Valery Popov <v.popov@postgrespro.ru>
Subject: Re: Password identifiers, protocol aging and SCRAM protocol
Date: Wed, 28 Sep 2016 12:25:43 +0300
Message-ID: <21507128-dc47-fe39-e90c-1ac85ef80aa7@iki.fi> (raw)
In-Reply-To: <CAB7nPqRhhJGhEeQn8omtS0x2s5YyjEuAtV1vdPt-7WVuC6OpcA@mail.gmail.com>
References: <CAB7nPqSL_V+0nD5i-XH_x1o5HTt2bT53vVwPUTHz8YT0hYRoPg@mail.gmail.com>
	<CA+TgmoZMn67CUgUxTD2vFgp7oHWH9qCHRUWebY6OSfSRVG5a_g@mail.gmail.com>
	<88f35221-2abd-6a31-a75d-28a3dc3a5b30@pgmasters.net>
	<29704.1469122290@sss.pgh.pa.us>
	<CAB7nPqRp74T70QELi8M8LHmMPXSzzBHwc3orAsQFuGbxB4o0HQ@mail.gmail.com>
	<19611.1469144923@sss.pgh.pa.us>
	<CAB7nPqRsUR09-eqmc5RVv8rvBk0nj4PctxL6YkKL73Tc47hSLg@mail.gmail.com>
	<20190.1469145748@sss.pgh.pa.us>
	<69938195-9c76-8523-0af8-eb718ea5b36e@iki.fi>
	<CAB7nPqRE3+5ptBRt2DpUP6WujofADGZ-Nc5nzZnhjQdUsE0p+Q@mail.gmail.com>
	<7fccb99f-8465-7ac8-72d5-3f41e90ae280@iki.fi>
	<CAB7nPqS9sWG5e6taBAo8O55rsptg-WL2-TAwVTzetiTicYdekw@mail.gmail.com>
	<47be24f5-12a5-7af8-efc0-9486a7dbd413@iki.fi>
	<CAB7nPqQzQnO11P_j1rEOzFjMRYNiDsAkzAbt111Srs-EONb9Zw@mail.gmail.com>
	<CAB7nPqRevzWkivfXZxpsBeKXhyUgHR+41mWKs78Fu=7srYFg4w@mail.gmail.com>
	<f606bf4d-6791-1b3a-a7e9-b676544b7f75@pgmasters.net>
	<CAB7nPqRhhJGhEeQn8omtS0x2s5YyjEuAtV1vdPt-7WVuC6OpcA@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

On 09/26/2016 09:02 AM, Michael Paquier wrote:
> On Mon, Sep 26, 2016 at 2:15 AM, David Steele <david@pgmasters.net> wrote:
>> * [PATCH 3/8] Switch password_encryption to a enum
>>
>> Does not apply on HEAD (98c2d3332):
>
> Interesting, it works for me on da6c4f6.
>
>> For here on I used 39b691f251 for review and testing.
>> I seems you are keeping on/off for backwards compatibility, shouldn't
>> the default now be "md5"?
>>
>> -#password_encryption = on
>> +#password_encryption = on              # on, off, md5 or plain
>
> That sounds like a good idea, so switched this way.

Committed this patch in the series, to turn password_encryption GUC into 
an enum.

There was one bug in the patch: if a plaintext password was given with 
CREATE/ALTER USER foo PASSWORD 'bar', but password_encryption was 'md5', 
it would incorrectly pass PASSWORD_TYPE_MD5 to the check-password hook. 
That would limit the amount of checking that the hook can do. Fixed 
that. Also edited the docs and comments a little bit, hopefully for the 
better.

Once we get the main SCRAM patch in, we may want to remove the "on" 
alias altogether. We don't promise backwards-compatibility of config 
files or GUC values, and not many people set password_encryption=on 
explicitly anyway, since it's the default. But I kept it now, as there's 
no ambiguity on what "on" means, yet.

- Heikki



-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (149+ messages)  latest in thread

Message-ID: <21507128-dc47-fe39-e90c-1ac85ef80aa7@iki.fi>
Permalink:  ../21507128-dc47-fe39-e90c-1ac85ef80aa7@iki.fi/
Also on:    postgresql.org/message-id/21507128-dc47-fe39-e90c-1ac85ef80aa7@iki.fi

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: hlinnaka@iki.fi, michael.paquier@gmail.com, david@pgmasters.net, tgl@sss.pgh.pa.us, robertmhaas@gmail.com, david@fetter.org, alvherre@2ndquadrant.com, magnus@hagander.net, peter.eisentraut@2ndquadrant.com, julian.markwort@uni-muenster.de, sfrost@snowman.net, v.popov@postgrespro.ru
  Subject: Re: Password identifiers, protocol aging and SCRAM protocol
  In-Reply-To: <21507128-dc47-fe39-e90c-1ac85ef80aa7@iki.fi>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox