Add new Pgpool-II config parameter allow_clear_text_frontend_auth

allow_clear_text_frontend_auth allows Pgpool-II to use clear text password
authentication with front-end clients, when pool_passwd file does not
contain the password for connecting user while the backend asks for
MD5 or SCRAM type authentication.
allow_clear_text_frontend_auth only works when pool_hba is not enabled

diff --git a/src/auth/pool_auth.c b/src/auth/pool_auth.c
index ae5af2f39b399feae58a4648cd2059414b1ced4c..645466615e0a12b7b113548db021f072676b912a 100644 (file)
--- a/src/auth/pool_auth.c
+++ b/src/auth/pool_auth.c
@@ -252,11 +252,12 @@ int pool_do_auth(POOL_CONNECTION *frontend, POOL_CONNECTION_POOL *cp)
                                 * we can still get the password from client using plain text authentication
                                 * if it is allowed by user
                                 */
-                               if (frontend->pool_hba == NULL /*&& config allows */)
+                               if (frontend->pool_hba == NULL && pool_config->allow_clear_text_frontend_auth)
                                {
                                        ereport(LOG,
-                                                       (errmsg("usign clear text authentication with frontend"),
-                                                        errdetail("backend will still use md5 auth")));
+                                               (errmsg("using clear text authentication with frontend"),
+                                                       errdetail("backend will still use md5 auth"),
+                                                        errhint("you can disable this behavior by setting allow_clear_text_frontend_auth to off")));
                                        authenticate_frontend_clear_text(frontend);
                                        /* now check again if we have a password now */
                                        if (get_auth_password(MASTER(cp), frontend, 0,
@@ -273,7 +274,7 @@ int pool_do_auth(POOL_CONNECTION *frontend, POOL_CONNECTION_POOL *cp)
                        {
                                ereport(ERROR,
                                        (errmsg("failed to authenticate with backend using md5"),
-                                                errdetail("password type is not valid")));
+                                                errdetail("valid password not found")));
                        }
                }
 
@@ -312,11 +313,12 @@ int pool_do_auth(POOL_CONNECTION *frontend, POOL_CONNECTION_POOL *cp)
                         * we can still get the password from client using plain text authentication
                         * if it is allowed by user
                         */
-                       if (frontend->pool_hba == NULL /*&& config allows */)
+                       if (frontend->pool_hba == NULL && pool_config->allow_clear_text_frontend_auth)
                        {
                                ereport(LOG,
-                                               (errmsg("usign clear text authentication with frontend"),
-                                                errdetail("backend will still use SCRAM auth")));
+                                       (errmsg("using clear text authentication with frontend"),
+                                                errdetail("backend will still use SCRAM auth"),
+                                                errhint("you can disable this behavior by setting allow_clear_text_frontend_auth to off")));
                                authenticate_frontend_clear_text(frontend);
                                /* now check again if we have a password now */
                                if (get_auth_password(MASTER(cp), frontend, 0,
@@ -333,7 +335,7 @@ int pool_do_auth(POOL_CONNECTION *frontend, POOL_CONNECTION_POOL *cp)
                {
                        ereport(ERROR,
                                        (errmsg("failed to authenticate with backend using SCRAM"),
-                                        errdetail("password type is not valid")));
+                                        errdetail("valid password not ")));
                }
 
                for (i=0;i<NUM_BACKENDS;i++)

diff --git a/src/config/pool_config_variables.c b/src/config/pool_config_variables.c
index bca7b22a44b8303afd71de70de0c598dc2ff057e..c44a9015ed4abe60ea731417833efa986e03ac13 100644 (file)
--- a/src/config/pool_config_variables.c
+++ b/src/config/pool_config_variables.c
@@ -516,6 +516,15 @@ static struct config_bool ConfigureNamesBool[] =
                false,
                NULL, NULL,NULL
        },
+       {
+               {"allow_clear_text_frontend_auth", CFGCXT_RELOAD, GENERAL_CONFIG,
+                       "allow to use clear text password authentication with clients, when pool_passwd does not contain the user password.",
+                       CONFIG_VAR_TYPE_BOOL,false, 0
+               },
+               &g_pool_config.allow_clear_text_frontend_auth,
+               false,
+               NULL, NULL,NULL
+       },
 
        /* End-of-list marker */
        EMPTY_CONFIG_BOOL

diff --git a/src/include/pool_config.h b/src/include/pool_config.h
index 4d0d49cf7cefca64ea66dc7203ed3a0af49a83eb..0194f9172ba4e5b0525f9339c1abe0c2f49f6652 100644 (file)
--- a/src/include/pool_config.h
+++ b/src/include/pool_config.h
@@ -153,7 +153,13 @@ typedef struct {
     int        connection_life_time;           /* if idle for this seconds, connection closes */
     int        child_max_connections;          /* if max_connections received, child exits */
        int client_idle_limit;                  /* If client_idle_limit is n (n > 0), the client is forced to be
-                                                                        *disconnected after n seconds idle */
+                                                                        * disconnected after n seconds idle */
+       bool allow_clear_text_frontend_auth;
+                                                                       /* enable Pgpool-II to use clear text password authentication
+                                                                        * between Pgpool and client to get the password
+                                                                        * when password for user does not exist in pool_password
+                                                                        * file.
+                                                                        */
        int authentication_timeout;             /* maximum time in seconds to complete client authentication */
     int        max_pool;                                       /* max # of connection pool per child */
     char *logdir;                                      /* logging directory */

diff --git a/src/sample/pgpool.conf.sample b/src/sample/pgpool.conf.sample
index e2acf06def629c4ef59b2d1875841d10ca509ba6..451c23b7a37c4857cc175d7e85b48022b75bdab6 100644 (file)
--- a/src/sample/pgpool.conf.sample
+++ b/src/sample/pgpool.conf.sample
@@ -91,6 +91,12 @@ authentication_timeout = 60
                                    # Delay in seconds to complete client authentication
                                    # 0 means no timeout.
 
+allow_clear_text_frontend_auth = off
+                                                                  # Allow Pgpool-II to use clear text password authentication
+                                                                  # with clients, when pool_passwd does not
+                                                                  # contain the user password
+
+
 # - SSL Connections -
 
 ssl = off

diff --git a/src/sample/pgpool.conf.sample-logical b/src/sample/pgpool.conf.sample-logical
index 064f6d1c8702cb964473307aa2c6aa364f896e7b..3f01bef32e3486276b570b8d442481a9b7021a69 100644 (file)
--- a/src/sample/pgpool.conf.sample-logical
+++ b/src/sample/pgpool.conf.sample-logical
@@ -92,6 +92,11 @@ authentication_timeout = 60
                                    # Delay in seconds to complete client authentication
                                    # 0 means no timeout.
 
+allow_clear_text_frontend_auth = off
+                                   # Allow Pgpool-II to use clear text password authentication
+                                   # with clients, when pool_passwd does not
+                                   # contain the user password
+
 # - SSL Connections -
 
 ssl = off

diff --git a/src/sample/pgpool.conf.sample-master-slave b/src/sample/pgpool.conf.sample-master-slave
index d67512296de41611a115572e7f7145a7fb12dfc0..0821ea8833cdf23714685a2661cd7060f287658a 100644 (file)
--- a/src/sample/pgpool.conf.sample-master-slave
+++ b/src/sample/pgpool.conf.sample-master-slave
@@ -91,6 +91,11 @@ authentication_timeout = 60
                                    # Delay in seconds to complete client authentication
                                    # 0 means no timeout.
 
+allow_clear_text_frontend_auth = off
+                                                                  # Allow Pgpool-II to use clear text password authentication
+                                                                  # with clients, when pool_passwd does not
+                                                                  # contain the user password
+
 # - SSL Connections -
 
 ssl = off

diff --git a/src/sample/pgpool.conf.sample-replication b/src/sample/pgpool.conf.sample-replication
index 2fd2906bff050843833e1730619d31fe3787111c..da4cdc06e9b25eeecbc1a92745686e3d775cce7c 100644 (file)
--- a/src/sample/pgpool.conf.sample-replication
+++ b/src/sample/pgpool.conf.sample-replication
@@ -90,6 +90,11 @@ authentication_timeout = 60
                                    # Delay in seconds to complete client authentication
                                    # 0 means no timeout.
 
+allow_clear_text_frontend_auth = off
+                                   # Allow Pgpool-II to use clear text password authentication
+                                   # with clients, when pool_passwd does not
+                                   # contain the user password
+
 # - SSL Connections -
 
 ssl = off

diff --git a/src/sample/pgpool.conf.sample-stream b/src/sample/pgpool.conf.sample-stream
index b64432f6dc27409cb595ae091acbf4fcce68b7a8..0e8d5c0994686af2f298807723af1278f3b6e356 100644 (file)
--- a/src/sample/pgpool.conf.sample-stream
+++ b/src/sample/pgpool.conf.sample-stream
@@ -92,6 +92,11 @@ authentication_timeout = 60
                                    # Delay in seconds to complete client authentication
                                    # 0 means no timeout.
 
+allow_clear_text_frontend_auth = off
+                                   # Allow Pgpool-II to use clear text password authentication
+                                   # with clients, when pool_passwd does not
+                                   # contain the user password
+
 # - SSL Connections -
 
 ssl = off

diff --git a/src/utils/pool_process_reporting.c b/src/utils/pool_process_reporting.c
index 1a04cd94a1d437d39a483e1490ca3ae447d7e4ec..2158c9f1773af985f2dda1c1a294e324e5ded598 100644 (file)
--- a/src/utils/pool_process_reporting.c
+++ b/src/utils/pool_process_reporting.c
@@ -213,6 +213,11 @@ POOL_REPORT_CONFIG* get_config(int *nrows)
        StrNCpy(status[i].desc, "maximum time in seconds to complete client authentication", POOLCONFIG_MAXNAMELEN);
        i++;
 
+       StrNCpy(status[i].name, "allow_clear_text_frontend_auth", POOLCONFIG_MAXNAMELEN);
+       snprintf(status[i].value, POOLCONFIG_MAXVALLEN, "%d", pool_config->allow_clear_text_frontend_auth);
+       StrNCpy(status[i].desc, "allow to use clear text password auth when pool_passwd does not contain password", POOLCONFIG_MAXDESCLEN);
+       i++;
+
        /* - SSL Connections - */
        StrNCpy(status[i].name, "ssl", POOLCONFIG_MAXNAMELEN);
        snprintf(status[i].value, POOLCONFIG_MAXVALLEN, "%d", pool_config->ssl);

diff --git a/src/watchdog/watchdog.c b/src/watchdog/watchdog.c
index 08f5a09a750458ecca0986ff6a72029a7f894926..4ee6ee51abde9f65a146ff6196a4ad136473aad7 100644 (file)
--- a/src/watchdog/watchdog.c
+++ b/src/watchdog/watchdog.c
@@ -6372,6 +6372,7 @@ static void verify_pool_configurations(WatchdogNode* wdNode, POOL_CONFIG* config
        WD_VERIFY_RECEIVED_CONFIG_PARAMETER_VAL_BOOL(config, wdNode, enable_pool_hba);
        WD_VERIFY_RECEIVED_CONFIG_PARAMETER_VAL_BOOL(config, wdNode, load_balance_mode);
        WD_VERIFY_RECEIVED_CONFIG_PARAMETER_VAL_BOOL(config, wdNode, replication_stop_on_mismatch);
+       WD_VERIFY_RECEIVED_CONFIG_PARAMETER_VAL_BOOL(config, wdNode, allow_clear_text_frontend_auth);
        WD_VERIFY_RECEIVED_CONFIG_PARAMETER_VAL_BOOL(config, wdNode, failover_if_affected_tuples_mismatch);
        WD_VERIFY_RECEIVED_CONFIG_PARAMETER_VAL_BOOL(config, wdNode, fail_over_on_backend_error);
        WD_VERIFY_RECEIVED_CONFIG_PARAMETER_VAL_BOOL(config, wdNode, replicate_select);

diff --git a/src/watchdog/wd_json_data.c b/src/watchdog/wd_json_data.c
index 58465c49614f352508c73ecc055bcfd485b390b5..328191d7d3d8cf0c85c9acb0f2e9b60f7971aa1b 100644 (file)
--- a/src/watchdog/wd_json_data.c
+++ b/src/watchdog/wd_json_data.c
@@ -68,6 +68,8 @@ POOL_CONFIG* get_pool_config_from_json(char* json_data, int data_len)
                goto ERROR_EXIT;
        if (json_get_bool_value_for_key(root, "replication_stop_on_mismatch", &config->replication_stop_on_mismatch))
                goto ERROR_EXIT;
+       if (json_get_bool_value_for_key(root, "allow_clear_text_frontend_auth", &config->allow_clear_text_frontend_auth))
+               goto ERROR_EXIT;
        if (json_get_bool_value_for_key(root, "failover_if_affected_tuples_mismatch", &config->failover_if_affected_tuples_mismatch))
                goto ERROR_EXIT;
        if (json_get_bool_value_for_key(root, "replicate_select", &config->replicate_select))
@@ -181,6 +183,7 @@ char* get_pool_config_json(void)
        jw_put_bool(jNode, "replication_mode", pool_config->replication_mode);
        jw_put_bool(jNode, "enable_pool_hba", pool_config->enable_pool_hba);
        jw_put_int(jNode, "load_balance_mode", pool_config->load_balance_mode);
+       jw_put_bool(jNode, "allow_clear_text_frontend_auth", pool_config->allow_clear_text_frontend_auth);
        jw_put_bool(jNode, "replication_stop_on_mismatch", pool_config->replication_stop_on_mismatch);
        jw_put_bool(jNode, "failover_if_affected_tuples_mismatch", pool_config->failover_if_affected_tuples_mismatch);
        jw_put_bool(jNode, "replicate_select", pool_config->replicate_select);