Message-ID: <a315a4df-43bd-535d-b0b3-632ba167e7bd@enterprisedb.com>
Date: Wed, 2 Mar 2022 16:29:29 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0)
 Gecko/20100101 Thunderbird/91.6.0
Subject: Re: Proposal: Support custom authentication methods using hooks
Content-Language: en-US
To: "Jonathan S. Katz" <jkatz@postgresql.org>,
 Stephen Frost <sfrost@snowman.net>, Michael Paquier <michael@paquier.xyz>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Jeff Davis <pgsql@j-davis.com>,
 samay sharma <smilingsamay@gmail.com>, pgsql-hackers@lists.postgresql.org
References: <1737574.1645753674@sss.pgh.pa.us>
 <54dc198b56a87e31e9625405383f04a8c6589b8b.camel@j-davis.com>
 <1905579.1645810764@sss.pgh.pa.us>
 <2718414dc095b716e59e126c03af343997d14c7b.camel@j-davis.com>
 <1980351.1645816239@sss.pgh.pa.us>
 <9004b18218eae293f1ee888e49d13d8a6b02810d.camel@j-davis.com>
 <20220228204634.GM10577@tamriel.snowman.net>
 <2738622.1646083128@sss.pgh.pa.us>
 <20220228214255.GO10577@tamriel.snowman.net> <Yh28j5PoG+mtAnSH@paquier.xyz>
 <20220301133119.GR10577@tamriel.snowman.net>
 <5de09fc4-8feb-8a91-d74a-fc9682208337@postgresql.org>
 <684c9d5b-2ab4-0546-4520-8e49a49ad1fb@enterprisedb.com>
 <115918cb-6009-3fac-712d-8d1eee3bb1a6@postgresql.org>
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
In-Reply-To: <115918cb-6009-3fac-712d-8d1eee3bb1a6@postgresql.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: <https://www.postgresql.org/message-id/a315a4df-43bd-535d-b0b3-632ba167e7bd%40enterprisedb.com>
Precedence: bulk


On 02.03.22 15:16, Jonathan S. Katz wrote:
>> I find that a lot of people are still purposely using md5.  Removing 
>> it now or in a year would be quite a disruption.
> 
> What are the reasons they are still purposely using it? The ones I have 
> seen/heard are:
> 
> - Using an older driver
> - On a pre-v10 PG
> - Unaware of SCRAM

I'm not really sure, but it seems like they are content with what they 
have and don't want to bother with the new fancy stuff.

> What I'm proposing above is to start the process of deprecating it as an 
> auth method, which also allows to continue the education efforts to 
> upgrae. Does that make sense?

I'm not in favor of starting a process that will result in removal of 
the md5 method at this time.