Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1oiUMH-0007hh-1A for pgsql-hackers@arkaria.postgresql.org; Wed, 12 Oct 2022 05:32:45 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1oiUMF-0007n9-Sl for pgsql-hackers@arkaria.postgresql.org; Wed, 12 Oct 2022 05:32:43 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1oiUMF-0007lb-JZ for pgsql-hackers@lists.postgresql.org; Wed, 12 Oct 2022 05:32:43 +0000 Received: from wout2-smtp.messagingengine.com ([64.147.123.25]) by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1oiUMD-0007Qr-0r for pgsql-hackers@lists.postgresql.org; Wed, 12 Oct 2022 05:32:42 +0000 Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.west.internal (Postfix) with ESMTP id C913A3200893; Wed, 12 Oct 2022 01:32:37 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute1.internal (MEProxy); Wed, 12 Oct 2022 01:32:38 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paquier.xyz; h= cc:cc:content-type:date:date:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to; s=fm3; t=1665552757; x=1665639157; bh=Q7Pj93pgLP XVzmgp2WrMV1RyGX2M/pwanqAP6B5SOjM=; b=PCfv2crtVeXiuuvpCgz0L9G8P0 EkzOVgUCKMx3vnQCqUZ455i6sYNEsZRhjAp2FvK5kJZI5sQtDtM9JEfoM2TXI7tI 96SCkslYkBoNxrqSdK8ehQ80/0GsmguKegcchdmDWf0j8ZcZKFaZLRgc+wUiaQdd 5y4VOs1YVkbQUOZhTlSR8fV5kLjUDmki6oKN1J9cE7QrjzqgHTPyymEMNrY+mCk7 UkidcD60vO+jWSOJmFVwKFUYCApNpro8SSWGqSRSJIsfFjDo/OmABZuQOboVEOwp 6eaiKj7yXypRCpxZTi24g8z3Ll24tAtZXuWBIXAZ2m+rmEpsV5BwbZO4zzLw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:date:date:feedback-id :feedback-id:from:from:in-reply-to:in-reply-to:message-id :mime-version:references:reply-to:sender:subject:subject:to:to :x-me-proxy:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm3; t=1665552757; x=1665639157; bh=Q7Pj93pgLPXVzmgp2WrMV1RyGX2M /pwanqAP6B5SOjM=; b=SmwAEkcbX9Yb6COdAz4xbTMXXSQCIbGsenFoA91R4zV4 fCvHTcW1L2uP4tVQ2CDiB83KvsdNaI+1KdFGbAlomVpRhlmFyOvKFzEK0ivqM9bk sZFqbvbSJ8VQw7oB/SeitClc5yabPmqkSihqBR/0TQN0RQ8CvQCkD6vm9XFJRACl C27Zghuc/G63kvz+Mm/+KFxkDJUsM6tMyzITShuu/+96qQlqqA7A6/1ELo49oQz9 Aj00+l5QW/l2v142sXOhNY9dszq9PzOgELrDskf35HXSrkOH6KcRHNg5uohcFmgd uSR16SAb1pdjnoeqq5kDPT3eAc/+WpI2kvjl/woU/w== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvfedrfeejjedgleekucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne gfrhhlucfvnfffucdljedtmdenucfjughrpeffhffvvefukfhfgggtuggjsehgtderredt tddvnecuhfhrohhmpefoihgthhgrvghlucfrrghquhhivghruceomhhitghhrggvlhesph grqhhuihgvrhdrgiihiieqnecuggftrfgrthhtvghrnhepteelieefudffhffhtdetleeg geegfffhkeeuveetiefgudduvedutefggeeivdejnecuvehluhhsthgvrhfuihiivgeptd enucfrrghrrghmpehmrghilhhfrhhomhepmhhitghhrggvlhesphgrqhhuihgvrhdrgiih ii X-ME-Proxy: Feedback-ID: i0fe9450f:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 12 Oct 2022 01:32:34 -0400 (EDT) Date: Wed, 12 Oct 2022 14:32:31 +0900 From: Michael Paquier To: Jacob Champion Cc: Stephen Frost , pgsql-hackers , Magnus Hagander , Peter Eisentraut , Tom Lane , Robert Haas Subject: Re: Kerberos delegation support in libpq and postgres_fdw Message-ID: References: <20220406192703.GY10577@tamriel.snowman.net> <20220408042126.GC10577@tamriel.snowman.net> <20220408122130.GD10577@tamriel.snowman.net> <23337c51-7a48-d5a8-569d-ef3ce6fe235f@timescale.com> <78ea2273-f370-5a78-903a-886511e2511c@timescale.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Ggv5C8wrR8hfSoLO" Content-Disposition: inline In-Reply-To: <78ea2273-f370-5a78-903a-886511e2511c@timescale.com> List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --Ggv5C8wrR8hfSoLO Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Sep 19, 2022 at 02:05:39PM -0700, Jacob Champion wrote: > It's not prevented, because a password is being used. In my tests I'm > connecting as an unprivileged user. >=20 > You're claiming that the middlebox shouldn't be doing this. If this new > default behavior were the historical behavior, then I would have agreed. > But the cat's already out of the bag on that, right? It's safe today. > And if it's not safe today for some other reason, please share why, and > maybe I can work on a patch to try to prevent people from doing it. Please note that this has been marked as returned with feedback in the current CF, as this has remained unanswered for a bit more than three weeks. -- Michael --Ggv5C8wrR8hfSoLO Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmNGUW8ACgkQnvQgOdby QH28UQ/+KyWIm1Mqw1UgvxbjBniQQYA9RrtvDo4cmJKfGmuvdwt917ak2A8dkrjN 69NyMMlUs9UlbhFSRrWNZ4SEUK1sEEeUQ1iOxP7ksV41IJ3n5gW7LBXz1e0ahFVF xUDyWBcysNRepFWCUtG5ts82FalivDW/DwbP3OXUoxVedwD9xO4cLGfP2c3ZD+il dD0I4JUBk6xVZyp/TfIfqZYJhcCjWw8JD4vJjRvUkxScwO876Ra8duGgXsf2U4ch zngqkpMZC1R/Fn9ci/tj9SV2C77kEdAaBVMBgP3LDcrwtnMmUyQluLGfK8sQz4Xw q68T1KYMsJNG1U/FLXB5uK7mfYiLoa/0zQ1SV4+YqdOWm7cvP/AWJVdoLMgQ2g+1 WdvkMbEcwg9TT2kcZpdCAy2LMjcu9mlD2xNoAcQZS5yvIT3GxySEYC17ZLBLuP4N 7ZHRmbvceWPM/mqiCDIn+bFBHPByKELkz5HBI5UTZl5vMdjHXhzDq2Kt421Fd41r tjXUnlC1q5AdlSqcH/8z9UJqwKL7+LPeESTpomORqVw8/7UE9HFflIaCJ8crrB1R xz+IXSZwZWpNAHVW3ir/oUM1XC/9zhA9qwtbRfXosU+8EiDIiruNGaaYR6o5E9hU n47bOawAJ6F9xk8WoVMxV6ELBKtVc4DciGY0gqnTT2sxxt9H4GA= =/ZcM -----END PGP SIGNATURE----- --Ggv5C8wrR8hfSoLO--