Initial Authentication Protocol

[Hydrocharged]

This implements the initial portion of the authentication protocol.

Postgres Reference Documentation:

• https://www.postgresql.org/docs/15/protocol-flow.html
• https://www.postgresql.org/docs/15/sasl-authentication.html

Primarily, this implements SASL SCRAM-SHA-256, which appears to be the primary form of authentication used in modern Postgres. It has been built by following the RFC specification:

• https://datatracker.ietf.org/doc/html/rfc5802

There are no tests since the implementation is incomplete. It cannot truly be tested until we have passwords and such that it can verify against (as the results must be sent back to the client for verification, so it can't be faked), however I have tested it up through what has been written, and what exists works as it should.

Surprisingly, there aren't any libraries that we could really leverage for this. Most SASL libraries don't implement SCRAM. The closest was the following:

• https://codeberg.org/mellium/sasl

However, I couldn't really find a way to integrate it using raw messages and the eventual Doltgres user backend, so this is all custom-written using the RFC as a guideline (along with capturing packets using the regression capture tool to ensure that Postgres follows the RFC's implementation). For now, the logic is hidden behind a bogus parameter check so that the static analyzer is happy, and the next step is to make a mock in-memory database of users and passwords so I can fully test the entire workflow.

[github-actions]

	Main	PR
Total	42090	42090
Successful	11790	11790
Failures	30300	30300
Partial Successes1	4788	4788

	Main	PR
Successful	28.0114%	28.0114%
Failures	71.9886%	71.9886%

Footnotes

1. These are tests that we're marking as Successful, however they do not match the expected output in some way. This is due to small differences, such as different wording on the error messages, or the column names being incorrect while the data itself is correct. ↩

[zachmu]

Looks fine but where are the tests?

[zachmu]

Surprisingly, there aren't any libraries that we could really leverage for this. Most SASL libraries don't implement SCRAM. The closest was the following:

I think using standard linux tools and bats / server tests is fine for this, we really just want some smoke tests that verify a range of basic queries work. It would be great if we had a unit test to exercise just the auth logic in go, but if that's hard I wouldn't call it a fast requirement. One thing we've done in other contexts is check required sample auth keys into source control to make it possible to test.