Horton

postgres_fdw: SCRAM authentication pass-through

Peter Eisentraut <peter@eisentraut.org>

View on postgr.es
Commit: 761c79508e7fbc33c1b11754bdde4bd03ce9cbb3
Author: Peter Eisentraut <peter@eisentraut.org>
Date: 2025-01-15T16:58:05Z
Releases: 18.0 
postgres_fdw: SCRAM authentication pass-through

This enables SCRAM authentication for postgres_fdw when connecting to
a foreign server without having to store a plain-text password on user
mapping options.

This is done by saving the SCRAM ClientKey and ServeryKey from the
client authentication and using those instead of the plain-text
password for the server-side SCRAM exchange.  The new foreign-server
or user-mapping option "use_scram_passthrough" enables this.

Co-authored-by: Matheus Alcantara <mths.dev@pm.me>
Co-authored-by: Peter Eisentraut <peter@eisentraut.org>
Discussion: https://www.postgresql.org/message-id/flat/27b29a35-9b96-46a9-bc1a-914140869dac@gmail.com

Files

PathChange+/−
contrib/postgres_fdw/connection.c modified +63 −6
contrib/postgres_fdw/expected/postgres_fdw.out modified +2 −2
contrib/postgres_fdw/Makefile modified +1 −0
contrib/postgres_fdw/meson.build modified +5 −0
contrib/postgres_fdw/option.c modified +3 −0
contrib/postgres_fdw/t/001_auth_scram.pl added +151 −0
doc/src/sgml/libpq.sgml modified +28 −0
doc/src/sgml/postgres-fdw.sgml modified +72 −0
src/backend/libpq/auth-scram.c modified +11 −3
src/include/libpq/libpq-be.h modified +9 −0
src/interfaces/libpq/fe-auth.c modified +1 −1
src/interfaces/libpq/fe-auth-scram.c modified +52 −31
src/interfaces/libpq/fe-connect.c modified +47 −0
src/interfaces/libpq/libpq-int.h modified +6 −0

Documentation touched

Discussion