Subject: Re: Password identifiers, protocol aging and SCRAM protocol
To: Michael Paquier <michael.paquier@gmail.com>,
 David Steele <david@pgmasters.net>
References: 
 <CAB7nPqSL_V+0nD5i-XH_x1o5HTt2bT53vVwPUTHz8YT0hYRoPg@mail.gmail.com>
 <CA+TgmoZMn67CUgUxTD2vFgp7oHWH9qCHRUWebY6OSfSRVG5a_g@mail.gmail.com>
 <88f35221-2abd-6a31-a75d-28a3dc3a5b30@pgmasters.net>
 <29704.1469122290@sss.pgh.pa.us>
 <CAB7nPqRp74T70QELi8M8LHmMPXSzzBHwc3orAsQFuGbxB4o0HQ@mail.gmail.com>
 <19611.1469144923@sss.pgh.pa.us>
 <CAB7nPqRsUR09-eqmc5RVv8rvBk0nj4PctxL6YkKL73Tc47hSLg@mail.gmail.com>
 <20190.1469145748@sss.pgh.pa.us>
 <69938195-9c76-8523-0af8-eb718ea5b36e@iki.fi>
 <CAB7nPqRE3+5ptBRt2DpUP6WujofADGZ-Nc5nzZnhjQdUsE0p+Q@mail.gmail.com>
 <7fccb99f-8465-7ac8-72d5-3f41e90ae280@iki.fi>
 <CAB7nPqS9sWG5e6taBAo8O55rsptg-WL2-TAwVTzetiTicYdekw@mail.gmail.com>
 <47be24f5-12a5-7af8-efc0-9486a7dbd413@iki.fi>
 <CAB7nPqQzQnO11P_j1rEOzFjMRYNiDsAkzAbt111Srs-EONb9Zw@mail.gmail.com>
 <CAB7nPqRevzWkivfXZxpsBeKXhyUgHR+41mWKs78Fu=7srYFg4w@mail.gmail.com>
 <f606bf4d-6791-1b3a-a7e9-b676544b7f75@pgmasters.net>
 <CAB7nPqRhhJGhEeQn8omtS0x2s5YyjEuAtV1vdPt-7WVuC6OpcA@mail.gmail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Robert Haas <robertmhaas@gmail.com>,
 David Fetter <david@fetter.org>, Alvaro Herrera <alvherre@2ndquadrant.com>,
 Magnus Hagander <magnus@hagander.net>,
 Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
 Julian Markwort <julian.markwort@uni-muenster.de>,
 Stephen Frost <sfrost@snowman.net>,
 PostgreSQL mailing lists <pgsql-hackers@postgresql.org>,
 Valery Popov <v.popov@postgrespro.ru>
From: Heikki Linnakangas <hlinnaka@iki.fi>
Message-ID: <21507128-dc47-fe39-e90c-1ac85ef80aa7@iki.fi>
Date: Wed, 28 Sep 2016 12:25:43 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Icedove/45.2.0
MIME-Version: 1.0
In-Reply-To: 
 <CAB7nPqRhhJGhEeQn8omtS0x2s5YyjEuAtV1vdPt-7WVuC6OpcA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On 09/26/2016 09:02 AM, Michael Paquier wrote:
> On Mon, Sep 26, 2016 at 2:15 AM, David Steele <david@pgmasters.net> wrote:
>> * [PATCH 3/8] Switch password_encryption to a enum
>>
>> Does not apply on HEAD (98c2d3332):
>
> Interesting, it works for me on da6c4f6.
>
>> For here on I used 39b691f251 for review and testing.
>> I seems you are keeping on/off for backwards compatibility, shouldn't
>> the default now be "md5"?
>>
>> -#password_encryption = on
>> +#password_encryption = on              # on, off, md5 or plain
>
> That sounds like a good idea, so switched this way.

Committed this patch in the series, to turn password_encryption GUC into 
an enum.

There was one bug in the patch: if a plaintext password was given with 
CREATE/ALTER USER foo PASSWORD 'bar', but password_encryption was 'md5', 
it would incorrectly pass PASSWORD_TYPE_MD5 to the check-password hook. 
That would limit the amount of checking that the hook can do. Fixed 
that. Also edited the docs and comments a little bit, hopefully for the 
better.

Once we get the main SCRAM patch in, we may want to remove the "on" 
alias altogether. We don't promise backwards-compatibility of config 
files or GUC values, and not many people set password_encryption=on 
explicitly anyway, since it's the default. But I kept it now, as there's 
no ambiguity on what "on" means, yet.

- Heikki


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers