Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1o7IL9-0007KD-Mm for pgsql-hackers@arkaria.postgresql.org; Fri, 01 Jul 2022 15:13:51 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1o7IL8-0007ru-Kj for pgsql-hackers@arkaria.postgresql.org; Fri, 01 Jul 2022 15:13:50 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1o7IL8-0007ri-79 for pgsql-hackers@lists.postgresql.org; Fri, 01 Jul 2022 15:13:50 +0000 Received: from mail-yb1-f169.google.com ([209.85.219.169]) by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1o7IL5-0005B5-6t for pgsql-hackers@postgresql.org; Fri, 01 Jul 2022 15:13:49 +0000 Received: by mail-yb1-f169.google.com with SMTP id x184so4516152ybg.12 for ; Fri, 01 Jul 2022 08:13:47 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=veprQdiTXdOf3/uAwCI4KKYl/lcL5AyWWiJ8BvCoVZ8=; b=zCz7BTtE2ZTTX2XDCylGY/So5bDhFBy0ir9mfVLWvHiek3gGKEBML+4SkpYkwf8Dm6 HpQIpJjM890gq1ExzKrzml+EvOE+iluV/wU6kke+M8vSN6kwxtPqCbLwTrDXob6T1LAl 6rbpLhYOb0TuMNmn6hQgQK6N8yOdMCkGY2VxT+SUA8K9KtMH5r1Yh5kLFeDBtI1PMaB/ 3zskYtfJZl23GYKffcEx/mqBTZKlg05593OUc8uxH9iBNxZkd7uyA7KBZBR0oN+wUfW0 VDd193JoKhT3wsZDi/4iefCP+g5VrcqO0WVO5tam8dQ95V+gstsqfna/9AZM7Di57Dj5 WKvg== X-Gm-Message-State: AJIora9chnnQ14uuxQEIefNbKnYm4S1I4oIBNPNTpwPITqcnRD5aGIcz 7kcZWnV16TWdmlAgniAp1qLkigukCcruHLh+p4Q= X-Google-Smtp-Source: AGRyM1tkVe3kgDsam4dyQ18EOI2FVD8BzBZMBMBzaLO8PEv4cs3YRxaTOwnxSp3wpFDTr6bMKZ8BWldF3wWjLOFmF70= X-Received: by 2002:a25:8f82:0:b0:66d:f6e9:843a with SMTP id u2-20020a258f82000000b0066df6e9843amr2335771ybl.232.1656688426009; Fri, 01 Jul 2022 08:13:46 -0700 (PDT) MIME-Version: 1.0 References: <20220701002034.GA9030@tamriel.snowman.net> <80684017-18c6-4116-9249-bb049ffe1ecf@amazon.com> In-Reply-To: <80684017-18c6-4116-9249-bb049ffe1ecf@amazon.com> From: Stephen Frost Date: Fri, 1 Jul 2022 11:13:35 -0400 Message-ID: Subject: Re: [PoC/RFC] Multiple passwords, interval expirations To: "Brindle, Joshua" Cc: Gurjeet Singh , Jacob Champion , PostgreSQL-development Content-Type: multipart/alternative; boundary="00000000000022c72b05e2bfd572" List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --00000000000022c72b05e2bfd572 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Greetings, On Fri, Jul 1, 2022 at 10:51 Brindle, Joshua wrote: > > On 6/30/22 8:20 PM, Stephen Frost wrote: > > * Gurjeet Singh (gurjeet@singh.im) wrote: > >> I am planning on picking it up next week; right now picking up steam, > >> and reviewing a different, smaller patch. > > Great! Glad that others are interested in this. > > > >> At his behest, I had a conversation with Joshua (OP), and have his > >> support to pick up and continue working on this patch. I have a some > >> ideas of my own, on what this patch should do, but since I haven't > >> fully reviewed the (bulky) patch, I'll reserve my proposals until I > >> wrap my head around it. > > I'd be curious as to your thought as to what the patch should be doing. > > Joshua and I had discussed it at some length as he was working on it. > > > Adding myself to the CC list here /waves Hi! I gave Gurjeet a bit of a brain dump on what I had planned (and what > we'd talked about), though he's free to take it in a different direction > if he wants. Perhaps though would certainly like this to patch to be useful for the use-cases that we had discussed, naturally. :) >> Please expect some activity on this patch towards the end of next week. > > I've gone ahead and updated it, cleaned up a couple things, and make it > > so that check-world actually passes with it. Attached is an updated > > version and I'll add it to the July commitfest. > > Ah, thanks. Hopefully it wasn't too horrible of a rebase. Wasn=E2=80=99t too bad.. needs more clean-up, there was some white space is= sues and some simple re-base stuff, but then the support for =E2=80=9Cmd5=E2=80=9D p= g_hba option was broken for users with SCRAM passwords because we weren=E2=80=99t checking i= f there was a SCRAM pw stored and upgrading to SCRAM in that case. That=E2=80=99s = the main case that I fixed. We will need to document this though, of course. The patch I submitted should basically do: pg_hba md5 + md5-only pws -> md5 auth used pg_hba md5 + scram-only pws -> scram pg_hba md5 + md5 and scram pws -> scram pg_hba scram -> scram Not sure if we need to try and do something to make it possible to have pg_hba md5 + mixed pws and have md5 used but it=E2=80=99s tricky as we woul= d have to know on the server side early on if that=E2=80=99s what we want to do. = We could add an option to md5 to say =E2=80=9Conly do md5=E2=80=9D maybe but I=E2=80= =99m also inclined to not bother and tell people to just get moved to scram already. For my 2c, I=E2=80=99d also like to move to having a separate column for th= e PW type from the actual secret but that=E2=80=99s largely an independent chang= e. Thanks! Stephen > --00000000000022c72b05e2bfd572 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Greetings,

On Fri, Jul 1, 2022 at 10:51 Brindle, Josh= ua <joshuqbr@amazon.com> w= rote:

On 6/30/22 8:20 PM, Stephen Frost wrote:
> * Gurjeet Singh (gurjeet@singh.im) wrote:
>> I am planning on picking it up next week; right now picking up ste= am,
>> and reviewing a different, smaller patch.
> Great!=C2=A0 Glad that others are interested in this.
>
>> At his behest, I had a conversation with Joshua (OP), and have his=
>> support to pick up and continue working on this patch. I have a so= me
>> ideas of my own, on what this patch should do, but since I haven&#= 39;t
>> fully reviewed the (bulky) patch, I'll reserve my proposals un= til I
>> wrap my head around it.
> I'd be curious as to your thought as to what the patch should be d= oing.
> Joshua and I had discussed it at some length as he was working on it.<= br>

Adding myself to the CC list here /waves

=
Hi!

I gave Gurjeet a bit of a brain dump on what I had planned (and what
we'd talked about), though he's free to take it in a different dire= ction
if he wants.

Perh= aps though would certainly like this to patch to be useful for the use-case= s that we had discussed, naturally. :)

>> Please expect some activity on this patch towards the end of next = week.
> I've gone ahead and updated it, cleaned up a couple things, and ma= ke it
> so that check-world actually passes with it.=C2=A0 Attached is an upda= ted
> version and I'll add it to the July commitfest.

Ah, thanks. Hopefully it wasn't too horrible of a rebase.
<= div dir=3D"auto">
Wasn=E2=80=99t too bad.. needs= more clean-up, there was some white space issues and some simple re-base s= tuff, but then the support for =E2=80=9Cmd5=E2=80=9D pg_hba option was brok= en for users with SCRAM passwords because we weren=E2=80=99t checking if th= ere was a SCRAM pw stored and upgrading to SCRAM in that case.=C2=A0 That= =E2=80=99s the main case that I fixed.=C2=A0 We will need to document this = though, of course.=C2=A0 The patch I submitted should basically do:

pg_hba md5 + md5-only pws ->= md5 auth used
pg_hba md5 + scram-only pws -> scr= am
pg_hba md5 + md5 and scram pws -> scram
<= div dir=3D"auto">pg_hba scram -> scram

=
Not sure if we need to try and do something to make it po= ssible to have pg_hba md5 + mixed pws and have md5 used but it=E2=80=99s tr= icky as we would have to know on the server side early on if that=E2=80=99s= what we want to do.=C2=A0 We could add an option to md5 to say =E2=80=9Con= ly do md5=E2=80=9D maybe but I=E2=80=99m also inclined to not bother and te= ll people to just get moved to scram already.=C2=A0
=
For my 2c, I=E2=80=99d also like to move to hav= ing a separate column for the PW type from the actual secret but that=E2=80= =99s largely an independent change.

Thanks!

Step= hen
--00000000000022c72b05e2bfd572--