public inbox for [email protected]  

help / color / mirror / Atom feed

From: Andreas Karlsson <[email protected]>
To: Thomas Munro <[email protected]>
To: pgsql-hackers <[email protected]>
Subject: Re: RADIUS tests and improvements
Date: Tue, 3 Jan 2023 22:03:55 +0100
Message-ID: <[email protected]> (raw)
In-Reply-To: <CA+hUKGKxNoVjkMCksnj6z3BwiS3y2v6LN6z7_CisLK+rv+0V4g@mail.gmail.com>
References: <CA+hUKGKxNoVjkMCksnj6z3BwiS3y2v6LN6z7_CisLK+rv+0V4g@mail.gmail.com>

On 1/3/23 04:11, Thomas Munro wrote:
> Here's a draft patch to tackle a couple of TODOs in the RADIUS code in auth.c.

Nice to see someone working on this! I know of one company which could 
have used the configurable timeout for radius because the 3 second 
timeout is too short for 2FA. I think they ended up using PAM or some 
other solution in the end, but I am not 100% sure.

> [...] While adding
> the GUC I couldn't help wondering why RADIUS even needs a timeout
> separate from authentication_timeout; another way to go here would be
> to remove it completely, but that'd be a policy change (removing the 3
> second timeout we always had).  Thoughts?

It was some time since I last looked at the code but my impression was 
that the reason for having a separate timeout is that you can try the 
next server after the first one timed out (multiple radius servers are 
allowed). But I wonder if that really is a useful feature or if someone 
just was too clever or it just was an accidental feature.

Andreas

view thread (9+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: RADIUS tests and improvements
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox