SCRAM protocol documentation

From: Peter Eisentraut <peter(dot)eisentraut(at)2ndquadrant(dot)com>
To: pgsql-hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: SCRAM protocol documentation
Date: 2017-08-11 01:57:36
Message-ID: 56e90a1f-15f9-ccfb-a2ce-f7d5e4c2c85e@2ndquadrant.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

The SCRAM protocol documentation
(https://www.postgresql.org/docs/devel/static/sasl-authentication.html)
states

"To avoid confusion, the client should use pg_same_as_startup_message as
the username in the client-first-message."

However, the client implementation in libpq doesn't actually do that, it
sends an empty string for the user name. I find no other reference to
"pg_same_as_startup_message" in the sources. Should the documentation
be updated?

Relatedly, the SCRAM specification doesn't appear to allow omitting the
user name in this manner. Why don't we just send the actual user name,
even though it's redundant with the startup message?

--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Augustine, Jobin 2017-08-11 01:58:48 Re: [HACKERS] Replication to Postgres 10 on Windows is broken
Previous Message Andres Freund 2017-08-11 01:55:12 Re: [HACKERS] Replication to Postgres 10 on Windows is broken