Re: Raising the SCRAM iteration count
Daniel Gustafsson <daniel@yesql.se>
From: Daniel Gustafsson <daniel@yesql.se>
To: Michael Paquier <michael@paquier.xyz>
Cc: "Jonathan S. Katz" <jkatz@postgresql.org>,
Andres Freund <andres@anarazel.de>,
PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Date: 2023-03-07T08:26:41Z
Lists: pgsql-hackers
> On 7 Mar 2023, at 05:53, Michael Paquier <michael@paquier.xyz> wrote: > > On Fri, Mar 03, 2023 at 11:13:36PM +0100, Daniel Gustafsson wrote: >> That would indeed be nice, but is there a way to do this without a complicated >> pump TAP expression? I was unable to think of a way but I might be missing >> something? > > A SET command refreshes immediately the cache information of the > connection in pqSaveParameterStatus()@libpq, so a test in password.sql > with \password would be enough to check the computation happens in > pg_fe_scram_build_secret() with the correct iteration number. Say > like: > =# SET scram_iterations = 234; > SET > =# \password > Enter new password for user "postgres": TYPEME > Enter it again: TYPEME > =# select substr(rolpassword, 1, 18) from pg_authid > where oid::regrole::name = current_role; > substr > -------------------- > SCRAM-SHA-256$234: > (1 row) > > Or perhaps I am missing something? Right, what I meant was: can a pg_regress sql/expected test drive a psql interactive prompt? Your comments suggested using password.sql so I was curious if I was missing a neat trick for doing this. -- Daniel Gustafsson
Commits
-
Test SCRAM iteration changes with psql \password
- bf5a894c5571 16.0 landed
-
Make SCRAM iteration count configurable
- b577743000cd 16.0 landed