database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-28 23:42:10 +03:00
Code Activity

postgres_fdw: SCRAM authentication pass-through

Browse Source 
This enables SCRAM authentication for postgres_fdw when connecting to
a foreign server without having to store a plain-text password on user
mapping options.

This is done by saving the SCRAM ClientKey and ServeryKey from the
client authentication and using those instead of the plain-text
password for the server-side SCRAM exchange.  The new foreign-server
or user-mapping option "use_scram_passthrough" enables this.

Co-authored-by: Matheus Alcantara <mths.dev@pm.me>
Co-authored-by: Peter Eisentraut <peter@eisentraut.org>
Discussion: https://www.postgresql.org/message-id/flat/27b29a35-9b96-46a9-bc1a-914140869dac@gmail.com
This commit is contained in:
Peter Eisentraut
2025-01-15 17:55:18 +01:00
parent b6463ea6ef
commit 761c79508e
14 changed files with 450 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
doc/src/sgml/libpq.sgml
View File

@ -2199,6 +2199,34 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
</listitem>
</varlistentry>
<varlistentry id="libpq-connect-scram-client-key" xreflabel="scram_client_key">
<term><literal>scram_client_key</literal></term>
<listitem>
<para>
The base64-encoded SCRAM client key. This can be used by foreign-data
wrappers or similar middleware to enable pass-through SCRAM
authentication. See <xref
linkend="postgres-fdw-options-connection-management"/> for one such
implementation. It is not meant to be specified directly by users or
client applications.
</para>
</listitem>
</varlistentry>
<varlistentry id="libpq-connect-scram-server-key" xreflabel="scram_server_key">
<term><literal>scram_server_key</literal></term>
<listitem>
<para>
The base64-encoded SCRAM server key. This can be used by foreign-data
wrappers or similar middleware to enable pass-through SCRAM
authentication. See <xref
linkend="postgres-fdw-options-connection-management"/> for one such
implementation. It is not meant to be specified directly by users or
client applications.
</para>
</listitem>
</varlistentry>
<varlistentry id="libpq-connect-service" xreflabel="service">
<term><literal>service</literal></term>
<listitem>

72
doc/src/sgml/postgres-fdw.sgml
View File

@ -770,6 +770,78 @@ OPTIONS (ADD password_required 'false');
</listitem>
</varlistentry>
<varlistentry>
<term><literal>use_scram_passthrough</literal> (<type>boolean</type>)</term>
<listitem>
<para>
This option controls whether <filename>postgres_fdw</filename> will
use the SCRAM pass-through authentication to connect to the foreign
server. With SCRAM pass-through authentication,
<filename>postgres_fdw</filename> uses SCRAM-hashed secrets instead of
plain-text user passwords to connect to the remote server. This
avoids storing plain-text user passwords in PostgreSQL system
catalogs.
</para>
<para>
To use SCRAM pass-through authentication:
<itemizedlist>
<listitem>
<para>
The remote server must request SCRAM authentication. (If desired,
enforce this on the client side (FDW side) with the option
<literal>require_auth</literal>.) If another authentication method
is requested by the server, then that one will be used normally.
</para>
</listitem>
<listitem>
<para>
The remote server can be of any PostgreSQL version that supports
SCRAM. Support for <literal>use_scram_passthrough</literal> is
only required on the client side (FDW side).
</para>
</listitem>
<listitem>
<para>
The user mapping password is not used. (It could be set to support
other authentication methods, but that would arguably violate the
point of this feature, which is to avoid storing plain-text
passwords.)
</para>
</listitem>
<listitem>
<para>
The server running <filename>postgres_fdw</filename> and the remote
server must have identical SCRAM secrets (encrypted passwords) for
the user being used on <filename>postgres_fdw</filename> to
authenticate on the foreign server (same salt and iterations, not
merely the same password).
</para>
<para>
As a corollary, if FDW connections to multiple hosts are to be
made, for example for partitioned foreign tables/sharding, then all
hosts must have identical SCRAM secrets for the users involved.
</para>
</listitem>
<listitem>
<para>
The current session on the PostgreSQL instance that makes the
outgoing FDW connections also must also use SCRAM authentication
for its incoming client connection. (Hence
<quote>pass-through</quote>: SCRAM must be used going in and out.)
This is a technical requirement of the SCRAM protocol.
</para>
</listitem>
</itemizedlist>
</para>
</listitem>
</varlistentry>
</variablelist>
</sect3>
</sect2>