Feature request: SCRAM-SHA-256 authentication

[Skorpeo]

Feature request: SCRAM-SHA-256 authentication

Hi,

I would like to see if you guys would be interested in implementing the SCRAM-SHA-256 authentication?

I have written a routine using aiosasl library but I have no experience with Cython and am having trouble implementing the aiosasl routine using cython. I can't use await expressions so I tried using loop.create_task inside Cython but I still get errors. I think I have written what I think is 80%-90% of what's required (albeit I can't test it so can't be sure). I have attached the code. I think some educated eyes may be able to perhaps fix the loose ends to make this work? I based my code on whats in the library.

This would also introduce aiosasl dependency...

relevant links:
postgres sasl-authentication
postgres message-formats

pgsram_mockup.py.zip

[elprans]

I don't think aiosasl is a good choice here. You cannot perform async calls from coreproto as the low level protocol handling does not use coroutines. SASL is not a very complicated protocol, I'd just implement it directly and incorporate it into the overall protocol state machine.

[Skorpeo]

yea I figured, I'll try to see if I can make it work without aiosasl

[tlocke]

Hello, we had a similar requirement for the pg8000 driver and the SCRAM functionality has been split off as a separate library:

https://github.com/tlocke/scramp

It's designed to be a general solution that should work in any context. But let me know if you need any changes. I should say that it doesn't support channel binding yet, but I intend to add it. Anyway, hope it's of some use :-)

[Skorpeo]

thanks, this is still on my todo list

[davidfetter]

Bump

[jkatz]

Hi!

There has been discussion on the PostgreSQL mailing list about making SCRAM-SHA-256 the default encryption method for PostgreSQL 13, which would be released roughly in Sep, 2020. This is to ensure there is enough time for PostgreSQL drivers to have support for this encryption method.

Please let me know if there is any way I can help.

(I have also used asyncpg in some of my projects and am a fan :-)

[jkatz]

I've made a rough attempt at adding SCRAM-SHA-256 support. You can see the first patch at it here:

jkatz@22908da

The main goal was to get it to work (it does) but there are certainly some optimizations that can be made, i.e. Cythonizing the SCRAM file. I'm also not thrilled about the guard around the discard_message in the general auth catch all, but again, it works.

I manually tested valid + invalid user/password combinations. There are some additional tests I need to check (i.e. a server advertising SCRAM but the password being encoded otherwise).

At present this does not support SCRAM-SHA-256-PLUS, but it leaves the option open of doing so in a few areas, i.e. by passing along the options the server advertises for channel binding, and trying to keep some of the channel binding variables somewhat non-hardcoded.

[jkatz]

For completeness sake, I have proposed a patch here: #437

Feedback welcome.

[jkatz]

Now that #437 is committed, I believe this can be closed 😄