Re: MD5 authentication needs help

Stephen Frost wrote:
> * Josh Berkus (josh(at)agliodbs(dot)com) wrote:

> > > 3) Using the user name for the MD5 storage salt allows the MD5 stored
> > > hash to be used on a different cluster if the user used the same
> > > password.
> >
> > This is a feature as well as a bug. For example, pgBouncer relies on
> > this aspect of md5 auth.
>
> It's not a feature and pgBouncer could be made to not rely on this.

Perhaps one of the requirements of a new auth method should be to allow
middlemen such as connection poolers. It's been over two years since I
had a look, but IIRC pgbouncer had the very ugly requirement of its own
copy of user/passwords in a file, and of course you had to update it
separately if you changed the password in the server. We need to make
it possible for it not to require any such thing.

--
Álvaro Herrera http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services