| From: | Robert Haas <robertmhaas(at)gmail(dot)com> |
|---|---|
| To: | Peter Eisentraut <peter(dot)eisentraut(at)2ndquadrant(dot)com> |
| Cc: | Michael Paquier <michael(dot)paquier(at)gmail(dot)com>, Stephen Frost <sfrost(at)snowman(dot)net>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Álvaro Hernández Tortosa <aht(at)8kdata(dot)com>, "pgsql-hackers(at)postgresql(dot)org" <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: [JDBC] Channel binding support for SCRAM-SHA-256 |
| Date: | 2017-09-15 15:42:36 |
| Message-ID: | CA+TgmoaKoZkQU9eHEVns=c+QS__8x2OavPrao6mLv=nMLmJGsA@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers pgsql-jdbc |
On Thu, Sep 14, 2017 at 12:58 PM, Peter Eisentraut
<peter(dot)eisentraut(at)2ndquadrant(dot)com> wrote:
> Second thoughts, to make things simpler. All we need for channel
> binding is a connection flag that says "I require channel binding". It
> could be modeled after the sslmode parameter, e.g., cbind=disable (maybe
> for debugging), cbind=prefer (default), cbind=require. If you specify
> "require", then libpq would refuse to proceed unless scram-sha2-256-plus
> (or future similar mechanisms) was offered for authentication.
+1, although I think cbind is too brief. I'd spell it out.
> We don't even need a parameter that specifies which channel binding type
> to use. If libpq implements tls-unique, it should always use that. We
> might need a flag for testing other types, but that should not be an
> in-the-user's-face option.
I'm not so sure about this part. Why don't we want to let users control this?
--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Robert Haas | 2017-09-15 15:59:18 | Re: Optimise default partition scanning while adding new partition |
| Previous Message | Robert Haas | 2017-09-15 15:39:25 | Re: Process startup infrastructure is a mess |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Dipesh Dangol | 2017-09-15 16:56:11 | pgjdbc logical replication client throwing exception |
| Previous Message | Daniel Gustafsson | 2017-09-15 14:19:18 | Re: Statement-level rollback |