emqx / emqx/emqx-auth-pgsql

Documentation for generating salted password lacking

Open
#223 3 comments 1 reaction 0 assignees View on GitHub
Dominant language
Erlang
Stars
36
Forks
30
PR merge metrics
No merged PRs in 30d

Description

The [documentation](https://docs.emqx.io/en/broker/v4.3/advanced/auth.html#how-to-generate-authentication-information) describes the process of how to generate a salted password. However, the description on point 2 really makes it very difficult to follow. It is described that "same salting rules and hash method as MySQL authentication" should be used. Presumably, [this](https://dev.mysql.com/doc/internals/en/secure-password-authentication.html#packet-Authentication::Native41) is the method referenced. This method however utilizes SHA1, whereas emqx_auth_pgsql also supports other cryptographic algorithms. In addition, there is no description about how the salt enters the equation (presumably in place of the randomized 20-bit sequence).

This really needs to be improved. I still cannot wrap my head around how to generate hashed passwords and salts in order to make the plugin able to authenticate.

IMHO, the plugin should use the methods available for cryptography in PostgreSQL, i.e. the [pgcrypto](https://www.postgresql.org/docs/9.2/pgcrypto.html#PGCRYPTO-ICFC-TABLE) `crypto` method, specifically designed for managing cryptography for passwords.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.