Re: [HACKERS] Authentication mechanisms categorization

2017-08-31 Thread Bruce Momjian
On Thu, Jul 20, 2017 at 01:00:50AM +0300, Álvaro Hernández Tortosa wrote: > I'm mostly convinced by the power of all the parameters that already > exist, given that you added both saslname and saslchannelbinding to the > already existing sslmode. That's great, and allows for very fine choosing

Re: [HACKERS] Authentication mechanisms categorization

2017-07-19 Thread Álvaro Hernández Tortosa
On 14/07/17 13:29, Michael Paquier wrote: On Fri, Jul 14, 2017 at 12:16 PM, Álvaro Hernández Tortosa wrote: If the parameter authmethod would rather be "authmethods", i.e., a list, I think it would be significantly more flexible. Yes, but the handling of a list becomes messier if there

Re: [HACKERS] Authentication mechanisms categorization

2017-07-14 Thread Michael Paquier
On Fri, Jul 14, 2017 at 12:16 PM, Álvaro Hernández Tortosa wrote: > If the parameter authmethod would rather be "authmethods", i.e., a list, > I think it would be significantly more flexible. Yes, but the handling of a list becomes messier if there are some other connection parameters that ar

Re: [HACKERS] Authentication mechanisms categorization

2017-07-14 Thread Álvaro Hernández Tortosa
On 14/07/17 11:09, Michael Paquier wrote: On Sat, Jul 8, 2017 at 2:19 PM, Álvaro Hernández Tortosa wrote: There has been some prior discussion, that we recently continued at pgday.ru, about what to do if a client wants to use a "strong" authentication mechanism but a rogue server forces

Re: [HACKERS] Authentication mechanisms categorization

2017-07-14 Thread Michael Paquier
On Sat, Jul 8, 2017 at 2:19 PM, Álvaro Hernández Tortosa wrote: > There has been some prior discussion, that we recently continued at > pgday.ru, about what to do if a client wants to use a "strong" > authentication mechanism but a rogue server forces the client to use a > weaker authenticati