Feedback-ID: i0fe9450f:Fastmail
Date: Mon, 20 Mar 2023 08:48:50 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Postgres hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Remove AUTH_REQ_KRB4 and AUTH_REQ_KRB5 in libpq code
Message-ID: <ZBefYoKDXcTHTtAF@paquier.xyz>
References: <ZBeKv/aCUV/FpJlT@paquier.xyz>
 <806567.1679266408@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="YH16yRrHmhzenPul"
Content-Disposition: inline
In-Reply-To: <806567.1679266408@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/ZBefYoKDXcTHTtAF%40paquier.xyz>
Precedence: bulk


--YH16yRrHmhzenPul
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Mar 19, 2023 at 06:53:28PM -0400, Tom Lane wrote:
> 9.2 is still within our "supported old versions" window, so it's
> at least plausible that somebody would hit this for KRB5.  Still,
> the net effect would be that they'd get "authentication method 2
> not supported" instead of "Kerberos 5 authentication not supported".
> I lean (weakly) to the idea that it's no longer worth the translation
> maintenance effort to keep the special message.
>=20
> A compromise could be to drop KRB4 but keep the KRB5 case for
> awhile yet.

Hmm.  I think that I would still drop both of them at the end, even in
v16 but I won't fight hard on that, either.  The only difference is
the verbosity of the error string generated, and there is still a
trace of what the code numbers were in pqcomm.h.

> One other thought is that I don't really like these comments
> implying that recycling these AUTH_REQ codes might be a good
> thing to do:
>=20
> +/* 1 is available. It was used for Kerberos V4, not supported any more  =
*/
>=20
> I think we'd be better off treating them as permanently retired.
> It's not like there's any shortage of code space to worry about.
> More, there might be other implementations of our wire protocol
> that still have support for these codes, so that re-using them
> could cause compatibility issues.  So maybe write "reserved"
> instead of "available"?

Okay, fine by me.
--
Michael

--YH16yRrHmhzenPul
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmQXn2IACgkQnvQgOdby
QH21EQ//TzEWbSy1CWbLliKOHDuzDsX57xMeau7G/q6lAKLvCm+ZtJ6oK+ulH8v6
nVi/3y/yp3sTMdXiWH8JxIi3I/TXG35eJ5Vj8vT7FkOS72gwxUfVIBV9XIq2GWBX
E2t8gDH0Bn4trn70Fws5OcHnzBQvLc2uF9wa3NJaluCxdI2kNSYxw7b3ZugEUetk
D4saYKe0tM3ieo1mULFGfPIFygbkJ9+uuZ2mismPvioqvHV7EGCatKk2DInoKUOe
MbKNgDz3ZZDXx2qnC63qnI/6QTHvMOFk5bzeqhgfZnL9GGFZjqBsqNbVSIAjyNbr
gApVQ6oxKuJJhYqsxey7SmiQucgnE7KARXxSQEb5LSxHI9jtlmQvqZ0uo7mChn+z
noOK79AjT5p22beK3JB30ZS1e8bkmYXyw2KXwKXnMID1Q2P8rYPqymbBf33LgPPD
ARC8xReULILB+pYU/MYYwe7X/0efX95DI6lOGpCa4X8GmwtjR/Ru8vrNFVCOKNpx
itaRMapdbrsjCIRfUXjbFDpvHi/p22H3LyEeKY/zSCTcWHIBRysuSnQL8qnPju8e
67JVgIPKoZUgYxYnfMNoQ0swDJhXBGsOGeaFp+sXLfn/YuB+aE0GmE9GSj+wbK7g
/xb0Mtp4k16p34RPR1Ukegoy5vrAwXbw1Yituxgg1cqB4FOAvCs=
=Gxos
-----END PGP SIGNATURE-----

--YH16yRrHmhzenPul--