• Peter Eisentraut's avatar
    Support channel binding 'tls-unique' in SCRAM · 9288d62b
    Peter Eisentraut authored
    This is the basic feature set using OpenSSL to support the feature.  In
    order to allow the frontend and the backend to fetch the sent and
    expected TLS Finished messages, a PG-like API is added to be able to
    make the interface pluggable for other SSL implementations.
    
    This commit also adds a infrastructure to facilitate the addition of
    future channel binding types as well as libpq parameters to control the
    SASL mechanism names and channel binding names.  Those will be added by
    upcoming commits.
    
    Some tests are added to the SSL test suite to test SCRAM authentication
    with channel binding.
    
    Author: Michael Paquier <michael@paquier.xyz>
    Reviewed-by: default avatarPeter Eisentraut <peter.eisentraut@2ndquadrant.com>
    9288d62b
fe-auth.c 31.9 KB