SCRAM-SHA-256, is it possible to retrieve enough information from PGserver (pg_authid etc) to perform authentication as a client - Mailing list pgsql-general

From Vladimir Soldatov
Subject SCRAM-SHA-256, is it possible to retrieve enough information from PGserver (pg_authid etc) to perform authentication as a client
Date
Msg-id CALn2wrc=OYF57=E-_HZJ_5kU_CicVrUghW=NnJnBETngR80DTw@mail.gmail.com
Whole thread Raw
Responses Re: SCRAM-SHA-256, is it possible to retrieve enough information from PG server (pg_authid etc) to perform authentication as a client
List pgsql-general
Hi guys,

I am new to PostgreSQL, so sorry for maybe stupid question. I am working on some application implementing Frontend/Backend PG protocol and one of the goals - having only "admin" users credentials (like postgres user) be able to retrieve enough information from PG server (for example, from pg_authid table) to perform authentication for any user created in PG (without any user interaction, so we don't know the user's password). 

It is fine for plain text or md5 authentication types, but it looks impossible for scram-sha-256, since looking at the RFC 5802 and libpq source code, the information presented in pg_authid (SCRAM-SHA-256$<iteration count>: <salt>$<StoredKey>:<ServerKey>) is enough only to perform server side authentication for external client and not enough to authenticate on the PG as a client. This actually sounds logically and reasonable in terms of infosec, so could you please that it is not possible or maybe there is any way to achieve that?

Thanks in advance,
Vladimir

pgsql-general by date:

Previous
From: Durumdara
Date:
Subject: PGSQL "macro" or "inplace subfunction"?
Next
From: Bharanee Rathna
Date:
Subject: Re: Altering multiple column types