pgwire/hba: support pg's clientcert methodoption

[knz]

PostgreSQL supports both:

• cert as a standalone auth method (currently supported in CockroachDB)
• the method option clientcert which can be added to any other method:

https://www.postgresql.org/docs/12/ssl-tcp.html#SSL-CLIENT-CERTIFICATES

add the authentication option clientcert=verify-ca or clientcert=verify-full to the appropriate hostssl line(s) in pg_hba.conf. A certificate will then be requested from the client during SSL connection startup.
For a hostssl entry with clientcert=verify-ca, the server will verify that the client's certificate is signed by one of the trusted certificate authorities. If clientcert=verify-full is specified, the server will not only verify the certificate chain, but it will also check whether the username or its mapping matches the cn (Common Name) of the provided certificate.
Note that certificate chain validation is always ensured when the cert authentication method is used (see Section 20.12).

Jira issue: CRDB-5113

[knz]

cc @aaron-crl maybe you have an opinion about alternate approaches to 2FA?

[aaron-crl]

Depending on implementation this might be a stretch for actual 2FA. The cert would have to live in a sealed hardware token otherwise it's virtually analogous to another password (and not 2FA).

Setting the above aside. I don't see harm coming from users configuring both.

However, if we wanted support for a more standard and industry accepted 2FA solution, I would recommend looking at something like TOTP (https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm) since we already have a very good time signal across CRDB nodes.

[knz]

@mattcrdb see aaron's comment above. Can you figure out what the user is plannign to do with their certificate management to ensure that certs are not just another form of password? Would they be interested in TOTP support?

[mattcrdb]

Sure, I'll follow up with the customer. Apologies for the delay here.

[knz]

I found out that this feature is already supported by postgres, and could be added to crdb at little cost.

Updated the top level issue description accordingly.

[github-actions]

We have marked this issue as stale because it has been inactive for
18 months. If this issue is still relevant, removing the stale label
or adding a comment will keep it active. Otherwise, we'll close it in
10 days to keep the issue queue tidy. Thank you for your contribution
to CockroachDB!