pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: Noah Misch <noah@leadboat.com>
Cc: Jeff Janes <jeff.janes@gmail.com>
Cc: Joe Conway <mail@joeconway.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: scram and \password
Date: Tue, 25 Apr 2017 14:29:59 -0400
Message-ID: <25550.1493144999@sss.pgh.pa.us> (raw)
In-Reply-To: <CA+Tgmob=P9zCS1Qrmane74m8q3EPnmY827o7OCZtotzrH-H2BQ@mail.gmail.com>
References: <a8b0d5cb-35d4-d686-3fae-f743659ae346@iki.fi>
	<CAB7nPqSjSmYK7H3S8A98giR6Jb=jKKTOMMruK1Kxw5Lfxc+Baw@mail.gmail.com>
	<fe2c096e-7b06-3e8e-0804-109def6b5d98@iki.fi>
	<CAB7nPqQ3QiPMgGv5OCz1wsocx7PHdZg5ursQOpyOb96AZuvmGA@mail.gmail.com>
	<5478ab75-404f-9490-9355-dc1365ce3d7f@iki.fi>
	<CAB7nPqTLzbHp5XmREoqiL31uF8VRz4jM1VhDRMZLOJuVg8gZoQ@mail.gmail.com>
	<dead641a-1fc8-0fd7-89d6-b818ac61b31a@iki.fi>
	<CAB7nPqQmJ5t=rd67paE7DWxuSi0C4X=5_pnzZchH7qFkBHy==A@mail.gmail.com>
	<CA+TgmoYk+xfnvYC4xtQD4qFdu7xKn6bRLC-baH5MDdtyCSxg6w@mail.gmail.com>
	<f56a2116-a466-ad6c-03d5-413294bfca9f@iki.fi>
	<20170410035323.GA2846583@tornado.leadboat.com>
	<CAB7nPqSbsCBCxy8-DtwzRxYgTnbGUtY4uFEkLQhG=R=uo=g8Fw@mail.gmail.com>
	<66e776c9-e02c-3683-28df-339f7f64ea66@iki.fi>
	<CAB7nPqSWP9J9PzeC7=-WjuuaL57_d+EawmzJNVsM+m7Y4gRRBA@mail.gmail.com>
	<c32a2be9-f25d-30e8-6d48-64e1801a910f@iki.fi>
	<CA+Tgmob=P9zCS1Qrmane74m8q3EPnmY827o7OCZtotzrH-H2BQ@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

Robert Haas <robertmhaas@gmail.com> writes:
> On Tue, Apr 25, 2017 at 11:26 AM, Heikki Linnakangas <hlinnaka@iki.fi> wrote:
>> A) Have PQencryptPassword() return an md5 hash.
>> 
>> B) Have PQencryptPassword() return a SCRAM verifier
>> 
>> C) Have PQencryptPassword() return a SCRAM verifier if connected to a v10
>> server, and an md5 hash otherwise. This is tricky, because PQencryptPassword
>> doesn't take a PGconn argument. It could behave like PQescapeString() does,
>> and choose md5/scram depending on the server version of the last connection
>> that was established.

> I vote for A - leave PQencryptPassword() as-is, and deprecate it.
> Tell people to use the new function going forward.

+1.  I never much liked that magic behavior of PQescapeString, and don't
think we should replicate it elsewhere, so I definitely don't like (C).
And I don't think we can do (B) because that will break the functionality
altogether when talking to an older server.  That leaves (A) plus invent
a new function.

			regards, tom lane


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (81+ messages)  latest in thread

Message-ID: <25550.1493144999@sss.pgh.pa.us>
Permalink:  ../25550.1493144999@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/25550.1493144999@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, robertmhaas@gmail.com, hlinnaka@iki.fi, michael.paquier@gmail.com, noah@leadboat.com, jeff.janes@gmail.com, mail@joeconway.com
  Subject: Re: scram and \password
  In-Reply-To: <25550.1493144999@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox