On Wed, Jan 18, 2017 at 02:30:38PM +0900, Michael Paquier wrote: > On Wed, Jan 18, 2017 at 2:23 PM, Noah Misch <n...@leadboat.com> wrote: > > The latest versions document this precisely, but I agree with Peter's > > concern > > about plain "scram". Suppose it's 2025 and PostgreSQL support SASL > > mechanisms > > OAUTHBEARER, SCRAM-SHA-256, SCRAM-SHA-256-PLUS, and SCRAM-SHA3-512. What > > should the pg_hba.conf options look like at that time? I don't think > > having a > > single "scram" option fits in such a world. > > Sure. > > > I see two strategies that fit: > > > > 1. Single "sasl" option, with a GUC, similar to ssl_ciphers, controlling the > > mechanisms to offer. > > 2. Separate options "scram_sha_256", "scram_sha3_512", "oauthbearer", etc. > > Or we could have a sasl option, with a mandatory array of mechanisms > to define one or more items, so method entries in pg_hba.conf would > look llke that: > sasl mechanism=scram_sha_256,scram_sha3_512
I like that. -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
