Re: Patch to add Heimdal kerberos support

On Wed, 14 Nov 2001, Tom Lane wrote:

> Bill Studenmund <wrstuden@netbsd.org> writes:
> > Is there interest in supporting encrypted sessions?
>
> We already have SSL support; it's not clear to me that it's worth our
> trouble to support a second mechanism.  Especially one that only works
> with one flavor of authentication.

I was unaware of the SSL support when I asked the question, and had seen
comments in the code about how we don't encrypt as it would break the
protocol if we did... Evidently we have figured out how to do one sort of
encryption. :-)

> I might be more interested if Kerberos were more popular ... but you're
> the first person who's done any work on the Kerberos code in the whole
> time I've been around the project, so I suspect it ain't of wide
> interest.

Two things: 1) at least two other people have worked on the kerberos code.
backend/libpq/auth.c revision 1.45 added the current krb5 support; that
came from someone. :-) And Peter said there has been one other Heimdal
patch, which also came from someone. :-)

Second, I agree with Peter that the current support is sub-optimal. *I*
wouldn't use it, as I really want session encryption. So if what we have
isn't what people want, is it any wonder they don't use it? :-)

I'll admit I don't expect folks to rush out and totally switch to
kerberos. But if we don't have the feature, no one will.

Also, I expect Kerberos to get more popular now that Windows is supporting
it.

From looking at the code, the ssl changes show exactly what has to happen
for data exchange to support other encryptions. Instead of recv() or
SSL_read(), we do a kerberos read and decrypt. The thing I'm not sure of
is how to have the backend tell the client it needs to do encryption. A
new "authmethod" would be an easy one, but there might be better ways.

Take care,

Bill