Feedback-ID: i0fe9450f:Fastmail
Date: Mon, 20 Mar 2023 07:20:47 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Postgres hackers <pgsql-hackers@lists.postgresql.org>
Subject: Remove AUTH_REQ_KRB4 and AUTH_REQ_KRB5 in libpq code
Message-ID: <ZBeKv/aCUV/FpJlT@paquier.xyz>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="W0ueyKBhk82eobV+"
Content-Disposition: inline
Archived-At: <https://www.postgresql.org/message-id/ZBeKv/aCUV/FpJlT%40paquier.xyz>
Precedence: bulk


--W0ueyKBhk82eobV+
Content-Type: multipart/mixed; boundary="V0DPvDeq+Axw4oOg"
Content-Disposition: inline


--V0DPvDeq+Axw4oOg
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Hi all,

$subject has been discussed here, still seems worth its own thread for
clarity:
https://www.postgresql.org/message-id/4037249.1679011812@sss.pgh.pa.us

Support for Kerberos v4 has been removed in a159ad3 (2005) and the
same happened for v5 in 98de86e (2014, meaning that this is still
possible with 9.2 and 9.3 backends).  Anyway, the attached seems worth
the simplifications now?  This includes a cleanup of protocol.sgml.

Thoughts?
--
Michael

--V0DPvDeq+Axw4oOg
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename="libpq-krb-cleanup.patch"
Content-Transfer-Encoding: quoted-printable

diff --git a/src/include/libpq/pqcomm.h b/src/include/libpq/pqcomm.h
index bff7dd18a2..8251639cd3 100644
--- a/src/include/libpq/pqcomm.h
+++ b/src/include/libpq/pqcomm.h
@@ -111,8 +111,8 @@ extern PGDLLIMPORT bool Db_user_namespace;
 /* These are the authentication request codes sent by the backend. */
=20
 #define AUTH_REQ_OK			0	/* User is authenticated  */
-#define AUTH_REQ_KRB4		1	/* Kerberos V4. Not supported any more. */
-#define AUTH_REQ_KRB5		2	/* Kerberos V5. Not supported any more. */
+/* 1 is available. It was used for Kerberos V4, not supported any more  */
+/* 2 is available. It was used for Kerberos V5, not supported any more  */
 #define AUTH_REQ_PASSWORD	3	/* Password */
 #define AUTH_REQ_CRYPT		4	/* crypt password. Not supported any more. */
 #define AUTH_REQ_MD5		5	/* md5 password */
diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c
index fa95f8e6e9..1ce0794f89 100644
--- a/src/interfaces/libpq/fe-auth.c
+++ b/src/interfaces/libpq/fe-auth.c
@@ -942,14 +942,6 @@ pg_fe_sendauth(AuthRequest areq, int payloadlen, PGcon=
n *conn)
 		case AUTH_REQ_OK:
 			break;
=20
-		case AUTH_REQ_KRB4:
-			libpq_append_conn_error(conn, "Kerberos 4 authentication not supported"=
);
-			return STATUS_ERROR;
-
-		case AUTH_REQ_KRB5:
-			libpq_append_conn_error(conn, "Kerberos 5 authentication not supported"=
);
-			return STATUS_ERROR;
-
 #if defined(ENABLE_GSS) || defined(ENABLE_SSPI)
 		case AUTH_REQ_GSS:
 #if !defined(ENABLE_SSPI)
diff --git a/doc/src/sgml/protocol.sgml b/doc/src/sgml/protocol.sgml
index 8b5e7b1ad7..ed7a3ceda1 100644
--- a/doc/src/sgml/protocol.sgml
+++ b/doc/src/sgml/protocol.sgml
@@ -271,20 +271,6 @@
       </listitem>
      </varlistentry>
=20
-     <varlistentry>
-      <term>AuthenticationKerberosV5</term>
-      <listitem>
-       <para>
-        The frontend must now take part in a Kerberos V5
-        authentication dialog (not described here, part of the
-        Kerberos specification) with the server.  If this is
-        successful, the server responds with an AuthenticationOk,
-        otherwise it responds with an ErrorResponse. This is no
-        longer supported.
-       </para>
-      </listitem>
-     </varlistentry>
-
      <varlistentry>
       <term>AuthenticationCleartextPassword</term>
       <listitem>
@@ -3318,41 +3304,6 @@ psql "dbname=3Dpostgres replication=3Ddatabase" -c "=
IDENTIFY_SYSTEM;"
     </listitem>
    </varlistentry>
=20
-   <varlistentry id=3D"protocol-message-formats-AuthenticationKerberosV5">
-    <term>AuthenticationKerberosV5 (B)</term>
-    <listitem>
-
-     <variablelist>
-      <varlistentry>
-       <term>Byte1('R')</term>
-       <listitem>
-        <para>
-         Identifies the message as an authentication request.
-        </para>
-       </listitem>
-      </varlistentry>
-
-      <varlistentry>
-       <term>Int32(8)</term>
-       <listitem>
-        <para>
-         Length of message contents in bytes, including self.
-        </para>
-       </listitem>
-      </varlistentry>
-
-      <varlistentry>
-       <term>Int32(2)</term>
-       <listitem>
-        <para>
-         Specifies that Kerberos V5 authentication is required.
-        </para>
-       </listitem>
-      </varlistentry>
-     </variablelist>
-    </listitem>
-   </varlistentry>
-
    <varlistentry id=3D"protocol-message-formats-AuthenticationCleartextPas=
sword">
     <term>AuthenticationCleartextPassword (B)</term>
     <listitem>

--V0DPvDeq+Axw4oOg--

--W0ueyKBhk82eobV+
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmQXir8ACgkQnvQgOdby
QH3aHw/+MEegAaKtq2tQA2QQtrs4IJt1hO2WP6p1nVisGKRu1S5Wl7rx46XgqCsL
xZahU2TKx4arRhehFWIwg10Uxa75MuUtcVFvCS60v7tL1daQ0UO0VGBeVxnPeHaD
/OSY5pK8Iv5/GL9QaxU0X+I8CG4KDNdIn8e1J4iOk9ttsJBfAOhtjlzjWK/f1o8J
D/Y+NGHUdZxW5s6ARsl/DcKQrwdQa+xV91npI8b33yOaltc/7swCD3te18riRlZI
VEbPj/LWIdGCzg5CVzLjqFCe9Rug4ThRQtyZlNaycgKmfjZkvKanS5D+NflKACE2
ld+LZRpfw89H5/uarXngrtoi8i93F9VmLOR0WzcU3NnBw9vzpozsCO7euLWvKtNI
GFCnUHHwWPA7MjL7H5nrLy4+SPLvphSa4Kdo6r/X+Rb+A2StTvGLAyt0VkMcsTNK
CLx5YKKsJkhzTsS+x+wT4T8RBZbOIkq2T3OC+RcMGZZX8wKR8CLZ0d4kLiPqYkjS
dyaUVGVan1G6lX+mcu52XYoBHl3gpluT5MuDNZIUVZA3Fn87D9PUJouPo14Wrewq
iI/uXhdbRrsKeLpRYSb5GiMNN2T5TUw3Fundj+R7ImDoCPQSiAI1GM/mC7B1vuSc
3nhJml4fWPPw1jLLbBdBv+WBJlNn9T/ZAjFv4ihL++wMlWfQRKA=
=fOZX
-----END PGP SIGNATURE-----

--W0ueyKBhk82eobV+--