From 3a465cc6783f586096d9f885c3fc544d82eb8f19 Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Tue, 14 Mar 2023 14:00:05 +0900 Subject: libpq: Add support for require_auth to control authorized auth methods The new connection parameter require_auth allows a libpq client to define a list of comma-separated acceptable authentication types for use with the server. There is no negotiation: if the server does not present one of the allowed authentication requests, the connection attempt done by the client fails. The following keywords can be defined in the list: - password, for AUTH_REQ_PASSWORD. - md5, for AUTH_REQ_MD5. - gss, for AUTH_REQ_GSS[_CONT]. - sspi, for AUTH_REQ_SSPI and AUTH_REQ_GSS_CONT. - scram-sha-256, for AUTH_REQ_SASL[_CONT|_FIN]. - creds, for AUTH_REQ_SCM_CREDS (perhaps this should be removed entirely now). - none, to control unauthenticated connections. All the methods that can be defined in the list can be negated, like "!password", in which case the server must NOT use the listed authentication type. The special method "none" allows/disallows the use of unauthenticated connections (but it does not govern transport-level authentication via TLS or GSSAPI). Internally, the patch logic is tied to check_expected_areq(), that was used for channel_binding, ensuring that an incoming request is compatible with conn->require_auth. It also introduces a new flag, conn->client_finished_auth, which is set by various authentication routines when the client side of the handshake is finished. This signals to check_expected_areq() that an AUTH_REQ_OK from the server is expected, and allows the client to complain if the server bypasses authentication entirely, with for example the reception of a too-early AUTH_REQ_OK message. Regression tests are added in authentication TAP tests for all the keywords supported (except "creds", because it is around only for compatibility reasons). A new TAP script has been added for SSPI, as there was no script dedicated to it yet. It relies on SSPI being the default authentication method on Windows, as set by pg_regress. Author: Jacob Champion Reviewed-by: Peter Eisentraut, David G. Johnston, Michael Paquier Discussion: https://postgr.es/m/9e5a8ccddb8355ea9fa4b75a1e3a9edc88a70cd3.camel@vmware.com --- doc/src/sgml/libpq.sgml | 115 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 115 insertions(+) (limited to 'doc/src') diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml index 3ccd8ff9421..3706d349abc 100644 --- a/doc/src/sgml/libpq.sgml +++ b/doc/src/sgml/libpq.sgml @@ -1220,6 +1220,111 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname + + require_auth + + + Specifies the authentication method that the client requires from the + server. If the server does not use the required method to authenticate + the client, or if the authentication handshake is not fully completed by + the server, the connection will fail. A comma-separated list of methods + may also be provided, of which the server must use exactly one in order + for the connection to succeed. By default, any authentication method is + accepted, and the server is free to skip authentication altogether. + + + Methods may be negated with the addition of a ! + prefix, in which case the server must not attempt + the listed method; any other method is accepted, and the server is free + not to authenticate the client at all. If a comma-separated list is + provided, the server may not attempt any of the + listed negated methods. Negated and non-negated forms may not be + combined in the same setting. + + + As a final special case, the none method requires the + server not to use an authentication challenge. (It may also be negated, + to require some form of authentication.) + + + The following methods may be specified: + + + + password + + + The server must request plaintext password authentication. + + + + + + md5 + + + The server must request MD5 hashed password authentication. + + + + + + gss + + + The server must either request a Kerberos handshake via + GSSAPI or establish a + GSS-encrypted channel (see also + ). + + + + + + sspi + + + The server must request Windows SSPI + authentication. + + + + + + scram-sha-256 + + + The server must successfully complete a SCRAM-SHA-256 authentication + exchange with the client. + + + + + + creds + + + The server must request SCM credential authentication (deprecated + as of PostgreSQL 9.1). + + + + + + none + + + The server must not prompt the client for an authentication + exchange. (This does not prohibit client certificate authentication + via TLS, nor GSS authentication via its encrypted transport.) + + + + + + + + channel_binding @@ -7774,6 +7879,16 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough) + + + + PGREQUIREAUTH + + PGREQUIREAUTH behaves the same as the connection parameter. + + + -- cgit v1.2.3