Re: Raising the SCRAM iteration count

Daniel Gustafsson <daniel@yesql.se>

From: Daniel Gustafsson <daniel@yesql.se>
To: Michael Paquier <michael@paquier.xyz>
Cc: "Jonathan S. Katz" <jkatz@postgresql.org>, Andres Freund <andres@anarazel.de>, PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Date: 2023-03-07T08:26:41Z
Lists: pgsql-hackers
> On 7 Mar 2023, at 05:53, Michael Paquier <michael@paquier.xyz> wrote:
> 
> On Fri, Mar 03, 2023 at 11:13:36PM +0100, Daniel Gustafsson wrote:
>> That would indeed be nice, but is there a way to do this without a complicated
>> pump TAP expression?  I was unable to think of a way but I might be missing
>> something?
> 
> A SET command refreshes immediately the cache information of the
> connection in pqSaveParameterStatus()@libpq, so a test in password.sql
> with \password would be enough to check the computation happens in
> pg_fe_scram_build_secret() with the correct iteration number.  Say
> like:
> =# SET scram_iterations = 234;
> SET
> =# \password
> Enter new password for user "postgres": TYPEME 
> Enter it again: TYPEME
> =# select substr(rolpassword, 1, 18) from pg_authid
>     where oid::regrole::name = current_role;
>       substr       
> --------------------
> SCRAM-SHA-256$234:
> (1 row)
> 
> Or perhaps I am missing something?

Right, what I meant was: can a pg_regress sql/expected test drive a psql
interactive prompt?  Your comments suggested using password.sql so I was
curious if I was missing a neat trick for doing this.

--
Daniel Gustafsson




Commits

  1. Test SCRAM iteration changes with psql \password

  2. Make SCRAM iteration count configurable