search

ngs-doo / revenj

DSL Platform compatible backend
https://dsl-platform.com
BSD 3-Clause "New" or "Revised" License
268 stars 44 forks source link

Use SCRAM-SHA-256 with SSL (SCRAM-SHA-256-PLUS not supported yet) #192

Closed Kobus-Smit closed 1 year ago

Kobus-Smit commented 1 year ago

SCRAM supported was added in https://github.com/ngs-doo/revenj/commit/31ace1d466722b246d6da890816fac8af9e94dd6 but it throws an exception when also using SSL:

Revenj.DatabasePersistence.Postgres.Npgsql.NpgsqlException:
Only Scram SHA 256 is supported
   at Revenj.DatabasePersistence.Postgres.Npgsql.NpgsqlState.ProcessBackendResponses_Ver_3(NpgsqlConnector context)+MoveNext() 
in csharp\Core\Revenj.Core\DatabasePersistence\Postgres\Npgsql\State\NpgsqlState.cs:line 658

SCRAM-SHA-256-PLUS was implemented in Npgsql PR 3111 and I tried to back port but was blocked by Npgsql using System.Net.Security.SslStream and Revenj's using Revenj.DatabasePersistence.Postgres.Npgsql.NpgsqlBufferedStream

I've noticed that if the client does not support SCRAM-SHA-256-PLUS channel binding, the client can continue to use SCRAM-SHA-256: NpgsqlConnector.Auth.cs#L139

I found reading the next stream string after SCRAM-SHA-256-PLUS returns SCRAM-SHA-256 and setting then saslAuthMechanism works as usual. I've tested the change on SSL and non-SSL configurations.