Re: pgsql: Use SASLprep to normalize passwords for SCRAM authentication.

From: Noah Misch <noah(at)leadboat(dot)com>
To: Heikki Linnakangas <heikki(dot)linnakangas(at)iki(dot)fi>
Cc: pgsql-hackers(at)postgresql(dot)org
Subject: Re: pgsql: Use SASLprep to normalize passwords for SCRAM authentication.
Date: 2017-04-11 04:22:18
Message-ID: 20170411042218.GA2870410@tornado.leadboat.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers pgsql-hackers

On Fri, Apr 07, 2017 at 11:58:10AM +0000, Heikki Linnakangas wrote:
> No documentation changes included, because there is no details on the
> SCRAM mechanism in the docs anyway. An overview on that in the protocol
> specification would probably be good, even though SCRAM is documented in
> detail in RFC5802. I'll write that as a separate patch. An important thing
> to mention there is that we apply SASLprep even on invalid UTF-8 strings,
> to support other encodings.

[Action required within three days. This is a generic notification.]

The above-described topic is currently a PostgreSQL 10 open item. Heikki,
since you committed the patch believed to have created it, you own this open
item. If some other commit is more relevant or if this does not belong as a
v10 open item, please let us know. Otherwise, please observe the policy on
open item ownership[1] and send a status update within three calendar days of
this message. Include a date for your subsequent status update. Testers may
discover new open items at any time, and I want to plan to get them all fixed
well in advance of shipping v10. Consequently, I will appreciate your efforts
toward speedy resolution. Thanks.

[1] https://www.postgresql.org/message-id/20170404140717.GA2675809%40tornado.leadboat.com

In response to

Browse pgsql-committers by date

  From Date Subject
Next Message Michael Meskes 2017-04-11 12:00:08 pgsql: Document that bytea is best represented as char * in C for ecpg.
Previous Message Andrew Dunstan 2017-04-10 23:57:15 pgsql: Run most pg_dump and pg_dumpall tests with --no-sync

Browse pgsql-hackers by date

  From Date Subject
Next Message Noah Misch 2017-04-11 04:23:52 Re: pgbench --progress-timestamp no longer works correctly
Previous Message Andrew Gierth 2017-04-11 04:17:56 Re: Ongoing issues with representation of empty arrays