Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1ZPCl4-0004Dz-1x for pgsql-hackers@arkaria.postgresql.org; Tue, 11 Aug 2015 16:50:38 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84) (envelope-from ) id 1ZPCl2-0003bp-PB for pgsql-hackers@arkaria.postgresql.org; Tue, 11 Aug 2015 16:50:36 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84) (envelope-from ) id 1ZPCjj-0000uw-8q for pgsql-hackers@postgresql.org; Tue, 11 Aug 2015 16:49:15 +0000 Received: from 01.zmailcloud.com ([192.198.85.104] helo=mx-out-1.zmailcloud.com) by magus.postgresql.org with esmtp (Exim 4.84) (envelope-from ) id 1ZPCjg-0006dK-1Q for pgsql-hackers@postgresql.org; Tue, 11 Aug 2015 16:49:14 +0000 Received: from smtp.01.com (smtp.01.com [10.10.0.43]) by mx-out-1.zmailcloud.com (Postfix) with ESMTP id E3E0E564C5D for ; Tue, 11 Aug 2015 11:49:10 -0500 (CDT) Received: from localhost (localhost [127.0.0.1]) by smtp-out-1.01.com (Postfix) with ESMTP id D38DEA07F4 for ; Tue, 11 Aug 2015 11:49:10 -0500 (CDT) X-Virus-Scanned: amavisd-new at smtp-out-1.01.com Received: from smtp.01.com ([127.0.0.1]) by localhost (smtp-out-1.01.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gx0Qwslv9VR9 for ; Tue, 11 Aug 2015 11:49:10 -0500 (CDT) Received: from smtp.01.com (localhost [127.0.0.1]) by smtp-out-1.01.com (Postfix) with ESMTP id B5BEAA07F6 for ; Tue, 11 Aug 2015 11:49:10 -0500 (CDT) Received: from localhost (localhost [127.0.0.1]) by smtp-out-1.01.com (Postfix) with ESMTP id 8C3E8A07F4 for ; Tue, 11 Aug 2015 11:49:10 -0500 (CDT) X-Virus-Scanned: amavisd-new at smtp-out-1.01.com Received: from smtp.01.com ([127.0.0.1]) by localhost (smtp-out-1.01.com [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id uVAre_cASMka for ; Tue, 11 Aug 2015 11:49:10 -0500 (CDT) Received: from [172.47.23.104] (50-0-190-244.dsl.dynamic.fusionbroadband.com [50.0.190.244]) by smtp-out-1.01.com (Postfix) with ESMTPSA id 2BDF2A07F6 for ; Tue, 11 Aug 2015 11:49:10 -0500 (CDT) Message-ID: <55CA2783.6040807@agliodbs.com> Date: Tue, 11 Aug 2015 09:49:07 -0700 From: Josh Berkus Organization: PostgreSQL Experts Inc. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.8.0 MIME-Version: 1.0 To: pgsql-hackers@postgresql.org Subject: Re: WIP: SCRAM authentication References: <55192AFE.6080106@iki.fi> <55C4FCC2.3000503@iki.fi> <55C63B1E.2040101@iki.fi> <55C79F0A.90601@agliodbs.com> <55CA22D6.2070202@agliodbs.com> In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Pg-Spam-Score: -2.6 (--) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org On 08/11/2015 09:35 AM, Robert Haas wrote: > On Tue, Aug 11, 2015 at 12:29 PM, Josh Berkus wrote: >> On 08/11/2015 07:28 AM, Robert Haas wrote: >>> There may be a good answer to this question, but I don't think I've >>> seen it spelled out clearly. >> >> Please see my follow-up post about making by-login-role migration easier >> for users. > > I read it, and now I've reread it, but I don't see how it addresses > the points I raised. I'm not disagreeing with your security argument, BTW, which is why I'm trying to come up with ways that make it easy for users to switch to SCRAM via gradual rollout. You're suggesting, then, that the switchover should be relatively easy, because drivers will support both MD5 and SCRAM, and once all drivers support both, the DBA can just swap verifiers? That makes sense if drivers go that way. I'm concerned that some drivers will have a different call for a SCRAM connection than for an MD5 one; we'd want to exert our project influence to prevent that from happening. That also makes it a bit harder to test the new auth on a few app servers before a general rollout, but there's ways around that. -- Josh Berkus PostgreSQL Experts Inc. http://pgexperts.com -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers