From: Michael Paquier <michael.paquier@gmail.com>
To: Robert Haas <robertmhaas@gmail.com>
Cc: David Steele <david@pgmasters.net>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Cc: Valery Popov <v.popov@postgrespro.ru>
Subject: Re: Password identifiers, protocol aging and SCRAM protocol
Date: Sat, 19 Mar 2016 03:07:26 +0900
Message-ID: <CAB7nPqS+i+HEfVskTrkrLGfVTYhOFfVCcHE4bX5FrOef2PcM5Q@mail.gmail.com> (raw)
In-Reply-To: <CA+TgmoYeui5crJyn4xxCZLUnxjtcZ1bzzF9-YN9NOQ-wr2f_uw@mail.gmail.com>
References: <CAB7nPqSMXU35g=W9X74HVeQp0uvgJxvYOuA4A-A3M+0wfEBv-w@mail.gmail.com>
<56E6D98F.1070701@pgmasters.net>
<CAB7nPqQYim-=PBHa19p04wSBbgGT=+ts1qWeQj2FG9HSmBX78Q@mail.gmail.com>
<CAB7nPqTssJpBUZ8g9oUTPJ6RPLCZYFtPypzdYgHL1gtuskxwkw@mail.gmail.com>
<56EAF483.3030307@pgmasters.net>
<CAB7nPqTkoC4NLyyivz2=usUOo47iZnS+2e14nkmVKM3P8hWqwA@mail.gmail.com>
<CA+TgmoYeui5crJyn4xxCZLUnxjtcZ1bzzF9-YN9NOQ-wr2f_uw@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
On Sat, Mar 19, 2016 at 12:28 AM, Robert Haas <robertmhaas@gmail.com> wrote:
> On Fri, Mar 18, 2016 at 9:31 AM, Michael Paquier
> <michael.paquier@gmail.com> wrote:
>> That's not an issue for me to rebase this set of patches. The only
>> conflicts that I anticipate are on 0009, but I don't have high hopes
>> to get this portion integrating into core for 9.6, the rest of the
>> patches is complicated enough, and everyone bandwidth is limited.
>
> I really think we ought to consider pushing this whole thing out to
> 9.7. I don't see how we're going to get all of this into 9.6, and
> these are big, user-facing changes that I don't think we should rush
> into under time pressure. I think it'd be better to do this early in
> the 9.7 cycle so that it has time to settle before the time crunch at
> the end. I predict this is going to have a lot of loose ends that are
> going to take months to settle, and we don't have that time right now.
> And I'd rather see all of the changes in one release than split them
> across two releases.
FWIW, the catalog separation is not that much a complicated patch, and
that's really a change independent on SCRAM, the main matter being to
manage critical index and relation entries correctly and it does not
touch the authentication code, which is what IMO is the sensitive
part. The catalog separation opens the door as well to multiple
verifiers for the same protocol for a single role, facilitating
password rolling policies, which is a feature that has been asked a
lot. Nothing prevents the development of moving validuntil into
pg_auth_verifiers in parallel of the SCRAM for the 9.7 release cycle,
though it would facilitate it to have some basic infra in place. Just
my 2c.
--
Michael
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: michael.paquier@gmail.com, robertmhaas@gmail.com, david@pgmasters.net, v.popov@postgrespro.ru
Subject: Re: Password identifiers, protocol aging and SCRAM protocol
In-Reply-To: <CAB7nPqS+i+HEfVskTrkrLGfVTYhOFfVCcHE4bX5FrOef2PcM5Q@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox