pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Peter Eisentraut <peter_e@gmx.net>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Josh Berkus <josh@agliodbs.com>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: WIP: SCRAM authentication
Date: Wed, 12 Aug 2015 15:53:09 -0400
Message-ID: <55CBA425.5070803@gmx.net> (raw)
In-Reply-To: <CA+TgmoZq6T=jsEr5sAW5Q3_63E4zaoim918e5fkb187AVmhr2g@mail.gmail.com>
References: <55192AFE.6080106@iki.fi>
	<CAB7nPqRB_Z2B7Lz96iHbHUQBQLwmUtj64hXu0u7mMZjpSk8UUg@mail.gmail.com>
	<CAB7nPqRBtLOT=g3q2-uYE=NbBdtkLubvDbV6wfCUp3hubpa6dg@mail.gmail.com>
	<CA+TgmoZ0XxXZeGa0f1uwaCN-FCjFsAJZdJgioeesdhfR7jmEhg@mail.gmail.com>
	<55C4FCC2.3000503@iki.fi>
	<CAB7nPqRWYJmw+qJrawP=h2J5s6LFea3NUb10VJJjdBNr1Wz=+g@mail.gmail.com>
	<CA+TgmoazGS0TpAtrFw+ft1UVUevBBXew5Lo6b1jtozgykpy5PA@mail.gmail.com>
	<55C63B1E.2040101@iki.fi>
	<CA+TgmoYQ=8BR87xgGkEWs8HJSe3KQh5v4fq+bZ2SAZhAnH3MtQ@mail.gmail.com>
	<WM!2607bf41b9a89b33119972f5b4afde40079604473d0e477f1dc436a9fa9e91fbe0abb7b542ebd7beba5c4d754eca070e!@asav-3.01.com>
	<55C79F0A.90601@agliodbs.com>
	<CA+TgmobMFiHiHt2_weFhZ-99kQNQz+h3mkTzm1aOX4ZMwOH-Yg@mail.gmail.com>
	<55CA4085.30101@gmx.net>
	<CA+TgmoYVE3Cg_HG=uZ_2NfMBbRstgNVMsOeVxHbfCUZfDhfxaA@mail.gmail.com>
	<55CB5D38.5090503@gmx.net>
	<CA+TgmoZq6T=jsEr5sAW5Q3_63E4zaoim918e5fkb187AVmhr2g@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

On 8/12/15 12:19 PM, Robert Haas wrote:
> On Wed, Aug 12, 2015 at 10:50 AM, Peter Eisentraut <peter_e@gmx.net> wrote:
>> I understand this idea, but I think it's not practical for many uses.
>> There is no way to find out, on the server, whether all current clients
>> would support a switch to SCRAM.  Let alone all not-current clients.
>> The only way to do such a switch would be to do the switch and then
>> check for connection failures in the log, which is not good.
> 
> Well, number one, I don't think we log anything currently that would
> let you figure that out;

We have options to log details about authenticated connections.  This
kind of thing could easily be added there.

> and number two, I'm not sure I believe that's
> the only way to make sure you've updated your clients.

Well, if there is another one, I haven't heard about it so far.

>> (Now that I think about this, to counter my point, this is very similar
>> to the switch from crypt to md5.  You couldn't turn that on until you
>> were sure that all clients would support it.  I don't remember the
>> experience from back then, though.)
> 
> Maybe we should try to find out how that played out.  It could inform
> the current discussion.

I think in those days, installations weren't very long-lived.  md5 was
introduced in version 7.2, which is also the first version with lazy vacuum.

> Another thing we might want to try to find out is: if we add SCRAM
> authentication to 9.6, how committed are drivers authors to adding
> that support to their drivers?  If we poll the maintainers of the
> drivers for Perl, Python, Ruby, Node.JS, Java, ODBC, etc. and involve
> them in this conversation, we might learn useful things.  This is a
> big change we're talking about, and it's only to work (regardless of
> the details) if the driver authors are on board.  We haven't, AFAIK,
> talked to them about this at all.

I'm not concerned about whether drivers are willing to support this.
These sort of things have usually worked out in the past.  But just
because a driver supports a new authentication method, that doesn't mean
everyone can or will upgrade to it right away.



-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (77+ messages)  latest in thread

Message-ID: <55CBA425.5070803@gmx.net>
Permalink:  ../55CBA425.5070803@gmx.net/
Also on:    postgresql.org/message-id/55CBA425.5070803@gmx.net

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: peter_e@gmx.net, robertmhaas@gmail.com, josh@agliodbs.com, hlinnaka@iki.fi, michael.paquier@gmail.com
  Subject: Re: WIP: SCRAM authentication
  In-Reply-To: <55CBA425.5070803@gmx.net>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox