aboutsummaryrefslogtreecommitdiff
path: root/src/backend/libpq/auth.c
Commit message (Collapse)AuthorAge
...
* pgindent run on all C files. Java run to follow. initdb/regressionBruce Momjian2001-10-25
| | | | tests pass.
* Fix authentication so that it doesn't record an extra 'PasswordTom Lane2001-10-18
| | | | | | | | | | authentication failed' and a 'send() failed: Broken pipe' message on every connection from psql in password auth mode. Problem is that psql doesn't ask user for a password until it sees a password challenge failure, and libpq just closes the connection unceremoniously if it's challenged for a password when it hasn't got one to send. Accordingly, EOF from the client after asking for a password is normal behavior and should not result in postmaster log entries.
* Disable local creds on OpenBSD because it doesn't support it. DocumentBruce Momjian2001-09-26
| | | | supported platforms in pg_hba.conf.
* Code review for MD5 authorization patch. Clean up some breakageTom Lane2001-09-21
| | | | (salts were always zero!?), add much missing documentation.
* Update SCM_CREDS for Net/Free/BSD-OS. Add configure checks.Bruce Momjian2001-09-07
|
* PAM authentication:Bruce Momjian2001-09-06
| | | | | | | | | | | | | | | | > pam_strerror() should be used a few more times, rather than just saying > "Error!". Also, the configure.in snippet seems wrong. You add > -I$pam_prefix/include/security to $INCLUDES and then you #include > <security/pam_appl.h>. This whole thing is probably unnecessary, since > PAM is a system library on the systems where it exists, so the headers > and libraries are found automatically, unlike OpenSSL and > Kerberos. See attached revised patch. (I'm sure the configure.in stuff can be done right/better, I'm just not enough of a autoconf guru to know what to change it to.) Dominic J. Eidson
* Add missing include for SCM_CREDS.Bruce Momjian2001-08-21
|
* Add SCM_CREDS to get owner of unix-domain socket on BSD-like systems.Bruce Momjian2001-08-21
|
* A little more code reorg for MD5/crypt.Bruce Momjian2001-08-17
|
* Reorder MD5/crypt so MD5 comes first in the code.Bruce Momjian2001-08-17
|
* Add 4-byte MD5 salt.Bruce Momjian2001-08-17
|
* Add new MD5 pg_hba.conf keyword. Prevent fallback to crypt.Bruce Momjian2001-08-16
|
* Remove protocol version change. Try MD5 first, then crypt() on all clients.Bruce Momjian2001-08-16
|
* Use MD5 for wire protocol encryption for >= 7.2 client/server.Bruce Momjian2001-08-15
| | | | | | | Allow pg_shadow to be MD5 encrypted. Add ENCRYPTED/UNENCRYPTED option to CREATE/ALTER user. Add password_encryption postgresql.conf option. Update wire protocol version to 2.1.
* Add a check for end of client connection before expecting a passwordPeter Eisentraut2001-08-07
| | | | response, to avoid noise in the server log.
* Support ident authentication on local (Unix) socket connections, if theTom Lane2001-08-01
| | | | | | system supports SO_PEERCRED requests for Unix sockets. This is an amalgamation of patches submitted by Helge Bahmann and Oliver Elphick, with some editorializing by yours truly.
* Source formatting cleanup.Bruce Momjian2001-07-21
|
* Handle reading of startup packet and authentication exchange after forkingPeter Eisentraut2001-06-20
| | | | | | | | | | a new postmaster child process. This should eliminate problems with authentication blocking (e.g., ident, SSL init) and also reduce problems with the accept queue filling up under heavy load. The option to send elog output to a different file per backend (postgres -o) has been disabled for now because the initialization would have to happen in a different order and it's not clear we want to keep this anyway.
* pgindent run. Make it all clean.Bruce Momjian2001-03-22
|
* Change Copyright from PostgreSQL, Inc to PostgreSQL Global Development Group.Bruce Momjian2001-01-24
|
* Ensure that all uses of <ctype.h> functions are applied to unsigned-charTom Lane2000-12-03
| | | | | values, whether the local char type is signed or not. This is necessary for portability. Per discussion on pghackers around 9/16/00.
* Make the location of the Kerberos server key file run time configurablePeter Eisentraut2000-08-25
| | | | | | | | | (rather than compile time). For libpq, even when Kerberos support is compiled in, the default user name should still fall back to geteuid() if it can't be determined via the Kerberos system. A couple of fixes for string type configuration parameters, now that there is one.
* Expand secondary password file feature, so that you can use thesePeter Eisentraut2000-07-04
| | | | | | files to restrict the set of users that can connect to a database but can still use the pg_shadow password. (You just leave off the password field in the secondary file.)
* Update kerberos patchBruce Momjian2000-05-27
|
* Back out kerberos changes. Causes compile problems.Bruce Momjian2000-05-27
|
* Patch for Kerberos V.Bruce Momjian2000-05-27
| | | | | | | | | | | | Most (nearly all) of the work was done by David Wragg <dpw@doc.ic.ac.uk> He patched 6.5.3. I've updated it for 7.0RC5. It works for MIT kerberos 1.1.1 (and previously for 1.0.6 as well). I've got the patch against 6.5.3, plus kerberized RPMS. Mike Wyer <mw@doc.ic.ac.uk> || "Woof?"
* Ye-old pgindent run. Same 4-space tabs.Bruce Momjian2000-04-12
|
* Add:Bruce Momjian2000-01-26
| | | | | | * Portions Copyright (c) 1996-2000, PostgreSQL, Inc to all files copyright Regents of Berkeley. Man, that's a lot of files.
* Look Ma, no MAX_PARSE_BUFFER! (At least not in the backend.Tom Lane1999-10-23
| | | | pg_dump and interfaces/odbc still need some work.)
* Lots of patches coming in from me today :-)Bruce Momjian1999-09-27
| | | | | | | | | | When drawing up a very simple "text-drawing" of how the negotiation is done, I realised I had done this last part (fallback) in a very stupid way. Patch #4 fixes this, and does it in a much better way. Included is also the simple text-drawing of how the negotiation is done. //Magnus
* Move some system includes into c.h, and remove duplicates.Bruce Momjian1999-07-17
|
* Final cleanup.Bruce Momjian1999-07-16
|
* Change #include's to use <> and "" as appropriate.Bruce Momjian1999-07-15
|
* Make functions static or NOT_USED as appropriate.Bruce Momjian1999-05-26
|
* pgindent run over code.Bruce Momjian1999-05-25
|
* Improve error messages when a connection is rejected.Tom Lane1999-04-16
|
* I've been having also sorts of fun trying to get kerberos 4Bruce Momjian1999-03-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | authentifica tion working with postgresql-6.4.2 and KTH-KRB Ebones (http://www.pdc.kth.se/kth-kr b) on a dec alpha running DU 4.0D using the native compiler. The following patch does the trick. The rationale behind this is as follows. The KTH-KRB code header files defines lots of lengths like INST_SZ,REALM_SZ and KRB_SENDAUTH_VLEN. It also has a habit of doing things like chararray[LENGTH] = '\0' to ensure null terminated strings. In my instance this just happens to blat the kerberos principal instance string leading to error like pg_krb4_recvauth: kerberos error: Can't decode authenticator (krb_rd_req ) The application code that comes with KTH-KRB uses "KRB_SENDAUTH_VLEN + 1" and sometimes uses "INST_SZ + 1" so it seems safest to put that 1 char buffer in the appropriate place. Rodney McDuff
* Change my-function-name-- to my_function_name, and optimizer renames.Bruce Momjian1999-02-13
|
* Initial attempt to clean up the code...Marc G. Fournier1998-12-14
| | | | | | Switch sprintf() to snprintf() Remove any/all #if 0 -or- #ifdef NOT_USED -or- #ifdef FALSE sections of code
* OK, folks, here is the pgindent output.Bruce Momjian1998-09-01
|
* Renaming cleanup, no pgindent yet.Bruce Momjian1998-09-01
|
* From: Tom Lane <tgl@sss.pgh.pa.us>Marc G. Fournier1998-07-09
| | | | | | | | | | | | | | | | | | Making PQrequestCancel safe to call in a signal handler turned out to be much easier than I feared. So here are the diffs. Some notes: * I modified the postmaster's packet "iodone" callback interface to allow the callback routine to return a continue-or-drop-connection return code; this was necessary to allow the connection to be closed after receiving a Cancel, rather than proceeding to launch a new backend... Being a neatnik, I also made the iodone proc have a typechecked parameter list. * I deleted all code I could find that had to do with OOB. * I made some edits to ensure that all signals mentioned in the code are referred to symbolically not by numbers ("SIGUSR2" not "2"). I think Bruce may have already done at least some of the same edits; I hope that merging these patches is not too painful.
* > I needed to do that for the web database that I'm setting up. WeBruce Momjian1998-06-13
| | | | | | | | have > 20000 users and each (potentially) needs a separate database which is > only accessible to them. Rather than having 20000 lines in pg_hba.conf, > I've patched Postgres so that the special token "sameuser" in the > database field of pg_hba.conf allows access only to the username which > is connecting.
* pgindent run before 6.3 release, with Thomas' requested changes.Bruce Momjian1998-02-26
|
* From: Jan Wieck <jwieck@debis.com>Marc G. Fournier1998-02-25
| | | | | | | | | | seems that my last post didn't make it through. That's good since the diff itself didn't covered the renaming of pg_user.h to pg_shadow.h and it's new content. Here it's again. The complete regression test passwd with only some float diffs. createuser and destroyuser work. pg_shadow cannot be read by ordinary user.
* From: Phil Thompson <phil@river-bank.demon.co.uk>Marc G. Fournier1998-01-31
| | | | | | | | | I haven't had final confirmation from Peter yet, but the attached patch needs to be applied for the Beta otherwise password and crypt authentication just won't work. It puts back the loop in libpq and also fixes a couple of problems with maintaining compatability with pre-6.3 drivers.
* From: Phil Thompson <phil@river-bank.demon.co.uk>Marc G. Fournier1998-01-29
| | | | | | | | | | | Attached is the patch to fix the warning messages from my code. I also fixed one which wasn't my code. Apart from the usual warnings about the bison/yacc generated code I only have one other warning message. This is in gramm.y around line 2234. I wasn't sure of the fix. I've also replaced all the calls to free() in gramm.y to calls to pfree(). Without these I was getting backend crashes with GRANT. This might already have been fixed.
* From: Phil Thompson <phil@river-bank.demon.co.uk>Marc G. Fournier1998-01-27
| | | | Cleanup patches for previous protocol changes patch
* Protocol cleanup from Phil.Bruce Momjian1998-01-27
|
* From: Phil Thompson <phil@river-bank.demon.co.uk>Marc G. Fournier1998-01-26
| | | | | | | | | | | | | | | | | | | I've completed the patch to fix the protocol and authentication issues I was discussing a couple of weeks ago. The particular changes are: - the protocol has a version number - network byte order is used throughout - the pg_hba.conf file is used to specify what method is used to authenticate a frontend (either password, ident, trust, reject, krb4 or krb5) - support for multiplexed backends is removed - appropriate changes to man pages - the -a switch to many programs to specify an authentication service no longer has any effect - the libpq.so version number has changed to 1.1 The new backend still supports the old protocol so old interfaces won't break.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-28 03:40:47 +0000