public inbox for [email protected]
help / color / mirror / Atom feedFrom: Tom Lane <[email protected]>
To: Adrian Vogelsgesang <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: Libpq: Fail connection attempt if server didn't request a password
Date: Fri, 15 Jan 2021 18:21:18 -0500
Message-ID: <[email protected]> (raw)
In-Reply-To: <BY5PR03MB4965271A9AE58B7367D1DB52A3A70@BY5PR03MB4965.namprd03.prod.outlook.com>
References: <BY5PR03MB4965271A9AE58B7367D1DB52A3A70@BY5PR03MB4965.namprd03.prod.outlook.com>
Adrian Vogelsgesang <[email protected]> writes:
> Is there some way to let libpq fail the connection attempt in such a case, i.e. if a password was provided but not requested from the server?
Why would that be a useful thing to do?
> 1. To identify misconfigured server. In our use case, all servers should require a password. By failing hard and early, we can more easily find misconfigured servers
I find that argument quite unconvincing. You can easily look into
pg_hba.conf to see if any lines don't have an auth method you like.
Moreover, that approach scales to requirements that are more complicated
than this specific use-case, and you can be sure that *all* the entries
satisfy your business rule, not just the one you happened to match this
time.
> Can I, as the client, force the authentication used during creating a connection to be scram-sha-256?
There has been discussion of that, but no one has written a patch yet.
regards, tom lane
view thread (2+ messages)
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected], [email protected]
Subject: Re: Libpq: Fail connection attempt if server didn't request a password
In-Reply-To: <[email protected]>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox