On Thu, Dec 15, 2016 at 8:40 AM, Stephen Frost <sfr...@snowman.net> wrote: > * Heikki Linnakangas (hlinn...@iki.fi) wrote: >> On 12/14/2016 04:57 PM, Stephen Frost wrote: >> >* Peter Eisentraut (peter.eisentr...@2ndquadrant.com) wrote: >> >>On 12/14/16 5:15 AM, Michael Paquier wrote: >> >>>I would be tempted to suggest adding the verifier type as a new column >> >>>of pg_authid >> >> >> >>Yes please. >> > >> >This discussion seems to continue to come up and I don't entirely >> >understand why we keep trying to shove more things into pg_authid, or >> >worse, into rolpassword. >> >> I understand the relational beauty of having a separate column for >> the verifier type, but I don't think it would be practical. > > I disagree.
Me, too. I think the idea of moving everything into a separate table that allows multiple verifiers is probably not a good thing to do just right now, because that introduces a bunch of additional issues above and beyond what we need to do to get SCRAM implemented. There are administration and policy decisions to be made there that we should not conflate with SCRAM proper. However, Heikki's proposal seems to be that it's reasonable to force rolpassword to be of the form 'type:verifier' in all cases but not reasonable to have separate columns for type and verifier. Eh? >> For >> starters, we'd still like to have a self-identifying string format >> like "scram-sha-256:<stuff>", so that you can conveniently pass the >> verifier as a string to CREATE USER. > > I don't follow why we can't change the syntax for CREATE USER to allow > specifying the verifier type independently. Generally speaking, I don't > expect *users* to be providing actual encoded *verifiers* very often, so > it seems like a bit of extra syntax that pg_dump has to use isn't that > big of a deal. We don't have to change the CREATE USER syntax at all. It could just split on the first colon and put the two halves of the string in different places. Of course, changing the syntax might be a good idea anyway -- or not --- but the point is, right now, when you look at rolpassword, there's not a clear rule for what kind of thing you've got in there. That's absolutely terrible design and has got to be fixed. Heikki's proposal of prefixing every entry with a type and a ':' will solve that problem and I'm not going to roll over in my grave if we do it that way, but there is such a thing as normalization and that technique could be applied here. -- Robert Haas EnterpriseDB: http://www.enterprisedb.com The Enterprise PostgreSQL Company -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
