On Mon, Jun 11, 2018 at 04:54:45PM +0200, Magnus Hagander wrote: > I'm wondering if that means we should then also not do it specifically for > scram in this version. Otherwise we're likely to end up with a parameter > that only has a "lifetime" of one version, and that seems like a bad idea. > If nothing else we should clearly think out what the path is to make sure > that doesn't happen. (e.g. we don't want a > scram_channel_binding_mode=require in this version, if the next one is > going to replace it with something like heikkis suggested > allowed_authentication_methods=SCRAM-SHA-256-PLUS or whatever we end up > coming up with there).
Conceptually, it depends on if we consider SCRAM and SCRAM+channel_binding as two separate authentication protocols. However it seems to me that as both are the same thing as they use the same protocol so it would be confusing for the user to be able to define both SCRAM-SHA-256 and SCRAM-SHA-256-PLUS within the same list, so I would tend to think that we should have in this future "allowed_authentication_methods" only scram-sha-256 listed as an option, which counts for both SCRAM with and without channel binding. Thinking harder about this thread, it could be as well possible in the future that we add support for channel binding for some other SASL mechanism, in which case I would tend to rename scram_channel_binding_type and scram_channel_binding_mode to simply channel_binding_type and channel_binding_mode, without any concepts of SCRAM attached to it. So in short, I'd like to keep both enforcement mechanisms as separate concepts. One future compatibility issue is how to deal with for example cases like allowed_authentication_methods="md5" and channel_binding_mode=require where an allowed authentication does not have channel binding? And it seems to me that this should result in an error. Opinions of others are welcome. -- Michael
signature.asc
Description: PGP signature