Re: dblink: Add SCRAM pass-through authentication
Jacob Champion <jacob.champion@enterprisedb.com>
From: Jacob Champion <jacob.champion@enterprisedb.com>
To: Peter Eisentraut <peter@eisentraut.org>
Cc: Matheus Alcantara <matheusssilv97@gmail.com>, PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Date: 2025-03-12T15:17:55Z
Lists: pgsql-hackers
Attachments
- fdw-test-v2.diff.txt (text/plain)
On Mon, Mar 10, 2025 at 11:25 AM Jacob Champion <jacob.champion@enterprisedb.com> wrote: > > On Fri, Mar 7, 2025 at 8:22 AM Peter Eisentraut <peter@eisentraut.org> wrote: > > Right. How about the attached? It checks as an alternative to a > > password whether the SCRAM keys were provided. That should get us back > > to the same level of checking? > > Yes, I think so. Attached is a set of tests to illustrate, mirroring > the dblink tests added upthread; they fail without this patch. In an offline discussion with Peter and Matheus, we figured out that this is still not enough. The latest patch checks that a password was used, but it doesn't ensure that the password material came from the SCRAM keys. Attached is an updated test to illustrate. Thanks, --Jacob
Commits
-
dblink: SCRAM authentication pass-through
- 3642df265d09 18.0 landed
-
postgres_fdw: improve security checks
- 76563f88cfbd 18.0 landed