pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Josh Berkus <josh@agliodbs.com>
To: Robert Haas <robertmhaas@gmail.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: WIP: SCRAM authentication
Date: Tue, 11 Aug 2015 11:00:18 -0700
Message-ID: <55CA3832.2050007@agliodbs.com> (raw)
In-Reply-To: <WM!39a8c7f86b5bf3ba8f889be54addba0dd4161969f5351abaa60f43844966d21b1fd04c2467666cef03f77de83d7ca304!@asav-1.01.com>
References: <55192AFE.6080106@iki.fi>
	<CA+TgmoazGS0TpAtrFw+ft1UVUevBBXew5Lo6b1jtozgykpy5PA@mail.gmail.com>
	<55C63B1E.2040101@iki.fi>
	<CA+TgmoYQ=8BR87xgGkEWs8HJSe3KQh5v4fq+bZ2SAZhAnH3MtQ@mail.gmail.com>
	<WM!2607bf41b9a89b33119972f5b4afde40079604473d0e477f1dc436a9fa9e91fbe0abb7b542ebd7beba5c4d754eca070e!@asav-3.01.com>
	<55C79F0A.90601@agliodbs.com>
	<CA+TgmobMFiHiHt2_weFhZ-99kQNQz+h3mkTzm1aOX4ZMwOH-Yg@mail.gmail.com>
	<WM!8377efcb6ac11602210dbca31b902143026c0f5deefaf62be6f2dabbe3a3e52aabed6c5aaa3488da842bc2bcdd9c181a!@asav-2.01.com>
	<55CA22D6.2070202@agliodbs.com>
	<CA+TgmoaHXyz02GrzBvWzgOzA1tR-1dz7BJzNfcOW3XrZ9Qqedg@mail.gmail.com>
	<WM!ee4bc06efa6b0e8150c0b52c63d21f8002f43a3ecc27e2ea0591d18d0e7a335f0dac169e82a99c1c75005f3bac0e6cc2!@asav-2.01.com>
	<55CA2783.6040807@agliodbs.com>
	<CA+TgmoaZGsc9otn6D=mJ4Ny_R56ZRX+ZtSwCd5_KK7yhjbEbqQ@mail.gmail.com>
	<WM!39a8c7f86b5bf3ba8f889be54addba0dd4161969f5351abaa60f43844966d21b1fd04c2467666cef03f77de83d7ca304!@asav-1.01.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

On 08/11/2015 10:06 AM, Robert Haas wrote:
> On Tue, Aug 11, 2015 at 12:49 PM, Josh Berkus <josh@agliodbs.com> wrote:
>> That makes sense if drivers go that way.  I'm concerned that some
>> drivers will have a different call for a SCRAM connection than for an
>> MD5 one; we'd want to exert our project influence to prevent that from
>> happening.
> 
> I'm not sure that would be a disaster, but do any existing drivers
> have a different call for a cleartext password
> (pg_hba.conf='password') than they do for an MD5 password
> (pg_hba.conf='md5')?  If not, I'm not sure why they'd add that just
> because there is now a third way of doing password-based
> authentication.

Well, there is a different send-and-response cycle to the SCRAM
approach, no?  Plus, I've seen driver authors do strange things in the
past, including PHP's various drivers and pypgsql, which IIRC required
you to manually pick a protocol version.  I'm not saying we should plan
for bad design, we should just get the word out to driver authors that
we think it would be a good idea to support both methods transparently.

>> That also makes it a bit harder to test the new auth on a few app
>> servers before a general rollout, but there's ways around that.
> 
> Well, staging servers are a good idea...

Don't get me started. :-b

-- 
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (77+ messages)  latest in thread

Message-ID: <55CA3832.2050007@agliodbs.com>
Permalink:  ../55CA3832.2050007@agliodbs.com/
Also on:    postgresql.org/message-id/55CA3832.2050007@agliodbs.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: josh@agliodbs.com, robertmhaas@gmail.com
  Subject: Re: WIP: SCRAM authentication
  In-Reply-To: <55CA3832.2050007@agliodbs.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox