mirror of
https://github.com/postgres/postgres.git
synced 2025-05-28 00:03:23 -04:00
4bbf110d2f
This parameter can be used to enforce the channel binding type used during a SCRAM authentication. This can be useful to check code paths where an invalid channel binding type is used by a client and will be even more useful to allow testing other channel binding types when they are added. The default value is tls-unique, which is what RFC 5802 specifies. Clients can optionally specify an empty value, which has as effect to not use channel binding and use SCRAM-SHA-256 as chosen SASL mechanism. More tests for SCRAM and channel binding are added to the SSL test suite. Author: Author: Michael Paquier <michael.paquier@gmail.com>
51 lines
1.5 KiB
Perl
51 lines
1.5 KiB
Perl
# Test SCRAM authentication and TLS channel binding types
|
|
|
|
use strict;
|
|
use warnings;
|
|
use PostgresNode;
|
|
use TestLib;
|
|
use Test::More tests => 4;
|
|
use ServerSetup;
|
|
use File::Copy;
|
|
|
|
# This is the hostname used to connect to the server.
|
|
my $SERVERHOSTADDR = '127.0.0.1';
|
|
|
|
# Allocation of base connection string shared among multiple tests.
|
|
my $common_connstr;
|
|
|
|
# Set up the server.
|
|
|
|
note "setting up data directory";
|
|
my $node = get_new_node('master');
|
|
$node->init;
|
|
|
|
# PGHOST is enforced here to set up the node, subsequent connections
|
|
# will use a dedicated connection string.
|
|
$ENV{PGHOST} = $node->host;
|
|
$ENV{PGPORT} = $node->port;
|
|
$node->start;
|
|
|
|
# Configure server for SSL connections, with password handling.
|
|
configure_test_server_for_ssl($node, $SERVERHOSTADDR, "scram-sha-256",
|
|
"pass", "scram-sha-256");
|
|
switch_server_cert($node, 'server-cn-only');
|
|
$ENV{PGPASSWORD} = "pass";
|
|
$common_connstr =
|
|
"user=ssltestuser dbname=trustdb sslmode=require hostaddr=$SERVERHOSTADDR";
|
|
|
|
# Default settings
|
|
test_connect_ok($common_connstr, '',
|
|
"SCRAM authentication with default channel binding");
|
|
|
|
# Channel binding settings
|
|
test_connect_ok($common_connstr,
|
|
"scram_channel_binding=tls-unique",
|
|
"SCRAM authentication with tls-unique as channel binding");
|
|
test_connect_ok($common_connstr,
|
|
"scram_channel_binding=''",
|
|
"SCRAM authentication without channel binding");
|
|
test_connect_fails($common_connstr,
|
|
"scram_channel_binding=not-exists",
|
|
"SCRAM authentication with invalid channel binding");
|