Horton

Re: scram and \password

Robert Haas <robertmhaas@gmail.com>

View thread View on postgr.es
From: Robert Haas <robertmhaas@gmail.com>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>, Tom Lane <tgl@sss.pgh.pa.us>, Jeff Janes <jeff.janes@gmail.com>, Joe Conway <mail@joeconway.com>, pgsql-hackers <pgsql-hackers@postgresql.org>
Date: 2017-03-17T12:01:43Z
Lists: pgsql-hackers 
On Thu, Mar 16, 2017 at 11:38 PM, Michael Paquier
<michael.paquier@gmail.com> wrote:
> On Thu, Mar 16, 2017 at 10:52 PM, Heikki Linnakangas <hlinnaka@iki.fi> wrote:
>> On 03/14/2017 11:14 PM, Tom Lane wrote:
>>>
>>> In short, I don't think that argument refutes my position that "md5"
>>> in pg_hba.conf should be understood as allowing SCRAM passwords too.
>>
>>
>> Yeah, let's do that. Here's a patch.
>
> At least this has the merit of making \password simpler from psql
> without a kind of --method option: if the backend is 9.6 or older,
> just generate a MD5-hash, and SCRAM-hash for newer versions.
> PQencryptPassword still needs to be extended so as it accepts a hash
> method though.

What if the user doesn't want to switch to SCRAM because they also use
some connector that hasn't been updated to support it?

I bet there will be a lot of people in that situation.

-- 
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

Commits

  1. Add PQencryptPasswordConn function to libpq, use it in psql and createuser.

  2. Allow SCRAM authentication, when pg_hba.conf says 'md5'.