Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1ZPDqh-00079k-57 for pgsql-hackers@arkaria.postgresql.org; Tue, 11 Aug 2015 18:00:31 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84) (envelope-from ) id 1ZPDqg-0005Um-Nc for pgsql-hackers@arkaria.postgresql.org; Tue, 11 Aug 2015 18:00:30 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84) (envelope-from ) id 1ZPDqe-0005Pq-ED for pgsql-hackers@postgresql.org; Tue, 11 Aug 2015 18:00:28 +0000 Received: from 01.zmailcloud.com ([192.198.85.104] helo=mx-out-1.zmailcloud.com) by magus.postgresql.org with esmtp (Exim 4.84) (envelope-from ) id 1ZPDqZ-00083n-Qb for pgsql-hackers@postgresql.org; Tue, 11 Aug 2015 18:00:27 +0000 Received: from smtp.01.com (smtp.01.com [10.10.0.43]) by mx-out-1.zmailcloud.com (Postfix) with ESMTP id 8E4CB565F31; Tue, 11 Aug 2015 13:00:22 -0500 (CDT) Received: from localhost (localhost [127.0.0.1]) by smtp-out-2.01.com (Postfix) with ESMTP id 7CCC660749; Tue, 11 Aug 2015 13:00:22 -0500 (CDT) X-Virus-Scanned: amavisd-new at smtp-out-2.01.com Received: from smtp.01.com ([127.0.0.1]) by localhost (smtp-out-2.01.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 88P3uJHZuATE; Tue, 11 Aug 2015 13:00:22 -0500 (CDT) Received: from smtp.01.com (localhost [127.0.0.1]) by smtp-out-2.01.com (Postfix) with ESMTP id 5ACBC6074B; Tue, 11 Aug 2015 13:00:22 -0500 (CDT) Received: from localhost (localhost [127.0.0.1]) by smtp-out-2.01.com (Postfix) with ESMTP id 443E16074A; Tue, 11 Aug 2015 13:00:22 -0500 (CDT) X-Virus-Scanned: amavisd-new at smtp-out-2.01.com Received: from smtp.01.com ([127.0.0.1]) by localhost (smtp-out-2.01.com [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id F-f-oT1omNkK; Tue, 11 Aug 2015 13:00:22 -0500 (CDT) Received: from [172.47.23.104] (50-0-190-244.dsl.dynamic.fusionbroadband.com [50.0.190.244]) by smtp-out-2.01.com (Postfix) with ESMTPSA id CDFEB60749; Tue, 11 Aug 2015 13:00:21 -0500 (CDT) Message-ID: <55CA3832.2050007@agliodbs.com> Date: Tue, 11 Aug 2015 11:00:18 -0700 From: Josh Berkus Organization: PostgreSQL Experts Inc. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.8.0 MIME-Version: 1.0 To: Robert Haas CC: "pgsql-hackers@postgresql.org" Subject: Re: WIP: SCRAM authentication References: <55192AFE.6080106@iki.fi> <55C63B1E.2040101@iki.fi> <55C79F0A.90601@agliodbs.com> <55CA22D6.2070202@agliodbs.com> <55CA2783.6040807@agliodbs.com> In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Pg-Spam-Score: -2.6 (--) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org On 08/11/2015 10:06 AM, Robert Haas wrote: > On Tue, Aug 11, 2015 at 12:49 PM, Josh Berkus wrote: >> That makes sense if drivers go that way. I'm concerned that some >> drivers will have a different call for a SCRAM connection than for an >> MD5 one; we'd want to exert our project influence to prevent that from >> happening. > > I'm not sure that would be a disaster, but do any existing drivers > have a different call for a cleartext password > (pg_hba.conf='password') than they do for an MD5 password > (pg_hba.conf='md5')? If not, I'm not sure why they'd add that just > because there is now a third way of doing password-based > authentication. Well, there is a different send-and-response cycle to the SCRAM approach, no? Plus, I've seen driver authors do strange things in the past, including PHP's various drivers and pypgsql, which IIRC required you to manually pick a protocol version. I'm not saying we should plan for bad design, we should just get the word out to driver authors that we think it would be a good idea to support both methods transparently. >> That also makes it a bit harder to test the new auth on a few app >> servers before a general rollout, but there's ways around that. > > Well, staging servers are a good idea... Don't get me started. :-b -- Josh Berkus PostgreSQL Experts Inc. http://pgexperts.com -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers