Feedback-ID: i131946ab:Fastmail
Message-ID: <ebf31cf7-b0af-7407-ada2-dda6d2767ba0@enterprisedb.com>
Date: Fri, 16 Sep 2022 16:56:20 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0)
 Gecko/20100101 Thunderbird/102.2.2
Subject: Re: [PoC] Let libpq reject unexpected authentication requests
Content-Language: en-US
To: Jacob Champion <jchampion@timescale.com>
Cc: "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>,
 Michael Paquier <michael@paquier.xyz>,
 "David G. Johnston" <david.g.johnston@gmail.com>
References: <9e5a8ccddb8355ea9fa4b75a1e3a9edc88a70cd3.camel@vmware.com>
 <YpcbXecOyxf8Zacb@paquier.xyz>
 <CAAWbhmihtCa0=Pg5mtTWTWmZ+onXSgx2QUbomv6NJprTLAiRBQ@mail.gmail.com>
 <CAAWbhmizLpLdCVj=6YaH92v+raLnFi=-tD6fppcRMtObLxV9ow@mail.gmail.com>
 <YqF92PYPhsjXNYWG@paquier.xyz>
 <CAAWbhmgL1M_yNUeS+Ear=UZoZ6G=tCX5rMx2rETNbjVJJtK40A@mail.gmail.com>
 <CAKFQuwabmJHf+68wo0=dd9EE=9H0RbO=S0SJ23Kpnn8peANZoA@mail.gmail.com>
 <CAAWbhmjOVfRr=Pjp3ZjcVLnHoXBXvn=hcjC2JV02cXB71uWjWg@mail.gmail.com>
 <CAAWbhmitLHUBkUUJmsG2CuVfH=OXTzj6pU1C8XYerYBM2TBfbQ@mail.gmail.com>
 <CAAWbhmi4V9zEAvfUSCDFx1pOr3ZWrV9fuxkv_2maRqvyc-m9PQ@mail.gmail.com>
 <CAAWbhmhjuHUfCs4NbB6p_MeuAgqq+et17SN=QR52HRH8zcMfFQ@mail.gmail.com>
 <77358b4c-6497-e5d3-c13c-57522654af25@enterprisedb.com>
 <CAAWbhmiKUFtkzF5_UFrJNssyTh2QEB7qF70K8zC9KWG0jMxmGw@mail.gmail.com>
 <adfab57e-bcc6-836b-0406-83bfe7f82061@enterprisedb.com>
 <CAAWbhmjMRCFjvjWu-=rmYCW4eRo8b1OjwyREm5QS-YFGGvex-w@mail.gmail.com>
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
In-Reply-To: 
 <CAAWbhmjMRCFjvjWu-=rmYCW4eRo8b1OjwyREm5QS-YFGGvex-w@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/ebf31cf7-b0af-7407-ada2-dda6d2767ba0%40enterprisedb.com>
Precedence: bulk

On 08.09.22 20:18, Jacob Champion wrote:
> Sounds fair. "cleartext"? "plaintext"? "plain" (like SASL's PLAIN)?

> On the SASL front: In the back of my head I'd been considering adding
> a "sasl:" prefix to "scram-sha-256", so that we have a namespace for
> new SASL methods. That would also give us a jumping-off point in the
> future if we decide to add SASL method negotiation to the protocol.
> What do you think about that?

After thinking about this a bit more, I think it would be best if the 
words used here match exactly with what is used in pg_hba.conf.  That's 
the only thing the user cares about: reject "password", reject "trust", 
require "scram-sha-256", etc.  How this maps to the protocol and that 
some things are SASL or not is not something they have needed to care 
about and don't really need to know for this.  So I would suggest to 
organize it that way.

Another idea:  Maybe instead of the "!" syntax, use two settings, 
require_auth and reject_auth?  Might be simpler?