Date: Tue, 19 Nov 2024 19:55:04 -0600
From: Nathan Bossart <nathandbossart@gmail.com>
To: Greg Sabino Mullane <htamfids@gmail.com>
Cc: Jim Nasby <jnasby@upgrade.com>, Andrew Dunstan <andrew@dunslane.net>,
	Tom Lane <tgl@sss.pgh.pa.us>, Heikki Linnakangas <hlinnaka@iki.fi>,
	pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: sunsetting md5 password support
Message-ID: <Zz1BeHjbHECYENmO@nathan>
References: <2735114.1728599306@sss.pgh.pa.us>
 <17ccc98a-108a-415d-a38c-f12b7baab90d@dunslane.net>
 <ZwmaW2AeUjBJGHgw@nathan>
 <Zw_cAwYO5bhaku3k@nathan>
 <Zx0RAAiMda8s0JZl@nathan>
 <CAKAnmmKq9EYTeUnmikfTL-1jKN2NXpGTN+8pYxsqfx3gYePEag@mail.gmail.com>
 <E70FC674-9B76-423C-A5F9-6372E828962E@upgrade.com>
 <ZyA0_8P8F3WHWnFu@nathan>
 <Zz0Zq39rd9WF1imY@nathan>
 <CAKAnmmJE_x81etTbh2-X0YcjQHCwVadNwiBqrm29iCU3PHOvGQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: 
 <CAKAnmmJE_x81etTbh2-X0YcjQHCwVadNwiBqrm29iCU3PHOvGQ@mail.gmail.com>
Archived-At: <https://www.postgresql.org/message-id/Zz1BeHjbHECYENmO%40nathan>
Precedence: bulk

On Tue, Nov 19, 2024 at 07:29:27PM -0500, Greg Sabino Mullane wrote:
> I just took a fresh look at / compiled this patch, and it all works as
> advertised. My one minor nit is this hint:
> 
> HINT:  Refer to the PostgreSQL documentation for details about migrating to
> another password type.
> 
> We don't really have that in the docs, as near as I can tell, the closest
> is 20.5 which says "make all users set new passwords, and change the
> authentication method specifications in pg_hba.conf to scram-sha-256."
> Maybe that's enough?

That was my initial thinking.  I think we have a few other options:

* Expand the documentation.  Perhaps we could add a step-by-step guide for
  migrating to SCRAM-SHA-256 since more users will need to do so when MD5
  password support is removed.
* Remove the hint.  It's arguably doing little more than pointing out the
  obvious, and it doesn't actually tell users where in the documentation to
  look for this information, anyway.
* Both of the above.

WDYT?

-- 
nathan