Message-ID: <684c9d5b-2ab4-0546-4520-8e49a49ad1fb@enterprisedb.com>
Date: Wed, 2 Mar 2022 09:24:26 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0)
 Gecko/20100101 Thunderbird/91.6.0
Subject: Re: Proposal: Support custom authentication methods using hooks
Content-Language: en-US
To: "Jonathan S. Katz" <jkatz@postgresql.org>,
 Stephen Frost <sfrost@snowman.net>, Michael Paquier <michael@paquier.xyz>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Jeff Davis <pgsql@j-davis.com>,
 samay sharma <smilingsamay@gmail.com>, pgsql-hackers@lists.postgresql.org
References: <1737574.1645753674@sss.pgh.pa.us>
 <54dc198b56a87e31e9625405383f04a8c6589b8b.camel@j-davis.com>
 <1905579.1645810764@sss.pgh.pa.us>
 <2718414dc095b716e59e126c03af343997d14c7b.camel@j-davis.com>
 <1980351.1645816239@sss.pgh.pa.us>
 <9004b18218eae293f1ee888e49d13d8a6b02810d.camel@j-davis.com>
 <20220228204634.GM10577@tamriel.snowman.net>
 <2738622.1646083128@sss.pgh.pa.us>
 <20220228214255.GO10577@tamriel.snowman.net> <Yh28j5PoG+mtAnSH@paquier.xyz>
 <20220301133119.GR10577@tamriel.snowman.net>
 <5de09fc4-8feb-8a91-d74a-fc9682208337@postgresql.org>
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
In-Reply-To: <5de09fc4-8feb-8a91-d74a-fc9682208337@postgresql.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: <https://www.postgresql.org/message-id/684c9d5b-2ab4-0546-4520-8e49a49ad1fb%40enterprisedb.com>
Precedence: bulk

On 01.03.22 22:17, Jonathan S. Katz wrote:
> If you're moving to a newer version of PostgreSQL, you likely have to 
> update your connection drivers anyway (rebuilt against new libpq, 
> supporting any changes in the protocol, etc). I would prefer more data 
> to support that argument, but this is generally what you need to do.
> 
> However, we may need to step towards it. We took one step last release 
> with defaulting to SCRAM. Perhaps this release we add a warning for 
> anything using md5 auth that "this will be removed in a future release." 
> (or specifically v16). We should also indicate in the docs that md5 is 
> deprecated and will be removed.

I find that a lot of people are still purposely using md5.  Removing it 
now or in a year would be quite a disruption.

It's also worth considering that keeping the code equipped to handle 
different kinds of password hashing would help it stay in shape if we 
ever need to add support for the next SHA after 256 or whatever.