From: Robbie Harwood <rharwood@redhat.com>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Stephen Frost <sfrost@snowman.net>
Subject: Re: [PATCH v12] GSSAPI encryption support
Date: Wed, 27 Jul 2016 13:12:27 -0400
Message-ID: <jlgpopzhuo4.fsf@thriss.redhat.com> (raw)
In-Reply-To: <CAB7nPqQpNXMVLDX4XGjcoQPzRFF-Hj5MDse=ac9jZP91X0cYcw@mail.gmail.com>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
<jlgy48ssyvl.fsf@thriss.redhat.com>
<20160406112105.GG10850@tamriel.snowman.net>
<jlg1t6isftk.fsf@thriss.redhat.com>
<1530.1459977031@sss.pgh.pa.us>
<jlgy48qqt86.fsf@thriss.redhat.com>
<5486.1459984857@sss.pgh.pa.us>
<CAB7nPqRPK1f4oAStwsy_Ty_Cjjo8U50HF0bRZi86my7va4nVdg@mail.gmail.com>
<jlgk2hq3uvr.fsf@thriss.redhat.com>
<jlg7fc91lko.fsf@thriss.redhat.com>
<CAB7nPqSmq1tuVGoVQXVb86y9SoaM-wcMDxHD1of9dGc54QYNSQ@mail.gmail.com>
<jlg7fc8fmq7.fsf@thriss.redhat.com>
<CAB7nPqQpNXMVLDX4XGjcoQPzRFF-Hj5MDse=ac9jZP91X0cYcw@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Michael Paquier <michael.paquier@gmail.com> writes:
> On Wed, Jul 27, 2016 at 12:22 AM, Robbie Harwood <rharwood@redhat.com> wrote:
>> Michael Paquier <michael.paquier@gmail.com> writes:
>>
>> So there's a connection setting `sslmode` that we'll want something
>> similar to here (`gssapimode` or so). `sslmode` has six settings, but I
>> think we only need three for GSSAPI: "disable", "allow", and "prefer"
>> (which presumably would be the default).
>
> Seeing the debate regarding sslmode these days, I would not say that
> "prefer" would be the default, but that's an implementation detail.
>
>> Lets suppose we're working with "prefer". GSSAPI will itself check two
>> places for credentials: client keytab and ccache. But if we don't find
>> credentials there, we as the client have two options on how to proceed.
>>
>> - First, we could prompt for a password (and then call
>> gss_acquire_cred_with_password() to get credentials), presumably with
>> an empty password meaning to skip GSSAPI. My memory is that the
>> current behavior for GSSAPI auth-only is to prompt for password if we
>> don't find credentials (and if it isn't, there's no reason not to
>> unless we're opposed to handling the password).
>>
>> - Second, we could skip GSSAPI and proceed with the next connection
>> method. This might be confusing if the user is then prompted for a
>> password and expects it to be for GSSAPI, but we could probably make
>> it sensible. I think I prefer the first option.
>
> Ah, right. I completely forgot that GSSAPI had its own handling of
> passwords for users registered to it...
>
> Isn't this distinction a good point for not implementing "prefer",
> "allow" or any equivalents? By that I mean that we should not have any
> GSS connection mode that fallbacks to something else if the first one
> fails. So we would live with the two following modes:
> - "disable", to only try a non-GSS connection
> - "enable", or "require", to only try a GSS connection.
> That seems quite acceptable to me as a first implementation to just
> have that.
If it is the password management that is scary here, we could have a
prefer-type mode which does not prompt, but only uses existing
credentials. Or we could opt to never prompt, which is totally valid.
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: rharwood@redhat.com, michael.paquier@gmail.com, tgl@sss.pgh.pa.us, sfrost@snowman.net
Subject: Re: [PATCH v12] GSSAPI encryption support
In-Reply-To: <jlgpopzhuo4.fsf@thriss.redhat.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox