mirror of
https://github.com/neondatabase/neon.git
synced 2026-01-10 15:02:56 +00:00
5f4ccae5c5
[proxy] Add the `password hack` authentication flow This lets us authenticate users which can use neither SNI (due to old libpq) nor connection string `options` (due to restrictions in other client libraries). Note: `PasswordHack` will accept passwords which are not encoded in base64 via the "password" field. The assumption is that most user passwords will be valid utf-8 strings, and the rest may still be passed via "password_".
45 lines
1.3 KiB
Python
45 lines
1.3 KiB
Python
import pytest
|
|
import json
|
|
import base64
|
|
|
|
|
|
def test_proxy_select_1(static_proxy):
|
|
static_proxy.safe_psql('select 1', options='project=generic-project-name')
|
|
|
|
|
|
def test_password_hack(static_proxy):
|
|
user = 'borat'
|
|
password = 'password'
|
|
static_proxy.safe_psql(f"create role {user} with login password '{password}'",
|
|
options='project=irrelevant')
|
|
|
|
def encode(s: str) -> str:
|
|
return base64.b64encode(s.encode('utf-8')).decode('utf-8')
|
|
|
|
magic = encode(json.dumps({
|
|
'project': 'irrelevant',
|
|
'password': password,
|
|
}))
|
|
|
|
static_proxy.safe_psql('select 1', sslsni=0, user=user, password=magic)
|
|
|
|
magic = encode(json.dumps({
|
|
'project': 'irrelevant',
|
|
'password_': encode(password),
|
|
}))
|
|
|
|
static_proxy.safe_psql('select 1', sslsni=0, user=user, password=magic)
|
|
|
|
|
|
# Pass extra options to the server.
|
|
#
|
|
# Currently, proxy eats the extra connection options, so this fails.
|
|
# See https://github.com/neondatabase/neon/issues/1287
|
|
@pytest.mark.xfail
|
|
def test_proxy_options(static_proxy):
|
|
with static_proxy.connect(options='-cproxytest.option=value') as conn:
|
|
with conn.cursor() as cur:
|
|
cur.execute('SHOW proxytest.option')
|
|
value = cur.fetchall()[0][0]
|
|
assert value == 'value'
|