From: Joe Conway <mail@joeconway.com>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: Jeff Janes <jeff.janes@gmail.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: scram and \password
Date: Sat, 11 Mar 2017 15:04:10 -0800
Message-ID: <75873498-ae3c-9b4f-e462-dc255cf14556@joeconway.com> (raw)
In-Reply-To: <CAB7nPqR0h4ZoLvYdXme-Ei7CJQu_AQOLpPbf1DFFXZCUAmaZWg@mail.gmail.com>
References: <CAMkU=1wfBgFPbfAMYZQE78p=VhZX7nN86aWkp0QcCp=+KxZ=bg@mail.gmail.com>
<CAB7nPqSELwmfwgOt8U_rK15sHWuGeLhsWYihRtq9ADC3MZ=HTg@mail.gmail.com>
<82d23d50-ba5d-69c1-99c9-7f28d5504b2e@joeconway.com>
<CAB7nPqR0h4ZoLvYdXme-Ei7CJQu_AQOLpPbf1DFFXZCUAmaZWg@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
On 03/11/2017 02:21 PM, Michael Paquier wrote:
> On Sun, Mar 12, 2017 at 5:35 AM, Joe Conway <mail@joeconway.com> wrote:
>> So if the password is not already set, \password uses
>> password_encryption to determine which format to use, and if the
>> password is already set, then the current method is assumed.
>
> Yeah, the problem here being that this routine does not need a live
> connection to work, and we surely don't want to make that mandatory,
> that's why I am suggesting something like the above. Another approach
> would be to switch to SCRAM once password_encryption does this switch
> as well... There is no perfect scenario here.
You might extend PQencryptPassword() to take a method. Or create a new
function that does? Certainly psql has a connection available to run the
ALTER ROLE command that it crafts.
I guess a related problem might be, do we have a SQL visible way to
determine what method is used by the current password for a given role?
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: mail@joeconway.com, michael.paquier@gmail.com, jeff.janes@gmail.com
Subject: Re: scram and \password
In-Reply-To: <75873498-ae3c-9b4f-e462-dc255cf14556@joeconway.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox