Skip to main content

pg_scram_unsupported_users

Function pg_scram_unsupported_users 

Source
fn pg_scram_unsupported_users(
    users: &HashMap<String, (PasswordVerifier, PermissionMode)>,
) -> Vec<&str>
Expand description

Returns the users whose verifier cannot back a Postgres SCRAM handshake.

Only PasswordVerifier::PlainText and PasswordVerifier::PgScramSha256 support SCRAM. A mysql_native_password verifier is a double-SHA1 digest unrelated to PBKDF2, and a pbkdf2_sha256 verifier was derived without SASLprep and cannot be safely reused as a SCRAM secret without the original password. Either kind forces the whole Postgres endpoint to fall back to cleartext (see postgres_auth_info_with_credential).