[ANN] Pharo P3 PostgreSQL client extended with SCRAM-SHA-256 authentication support

Previous Topic Next Topic
classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

[ANN] Pharo P3 PostgreSQL client extended with SCRAM-SHA-256 authentication support

Sven Van Caekenberghe-2

P3, the modern, lean and mean PostgreSQL client for Pharo has been extended with SCRAM-SHA-256 authentication support.


To authenticate users when a client connects to the database, several mechanisms are offered by PostgreSQL. Previously, the following methods were supported in P3:

- trust (no password)
- password (plain text password)
- md5 (MD5 based challenge/response)

More recent versions of PostgreSQL offer a method called 'scram-sha-256', which is an improved challenge/response scheme using more advanced cryptographic techniques.

To make this feature possible, a couple of these cryptography techniques had to be implemented:

- https://en.wikipedia.org/wiki/Simple_Authentication_and_Security_Layer
- https://en.wikipedia.org/wiki/Salted_Challenge_Response_Authentication_Mechanism
- https://en.wikipedia.org/wiki/PBKDF2

This is all a bit technical, but if there are PostgreSQL users out there that do understand this, you could help with testing this new feature - the main README file has been updated with a 'Connection and Authentication' section.

The development work for adding this feature (as open source) was generously paid for by Ingenieurbüro für Bauwesen Schmidt GmbH (in collaboration with Richard Uttner of Projector Software GmbH and Pavel Krivanek) - thank you.



Sven Van Caekenberghe
Proudly supporting Pharo