From trust to Tokens: A Short History of PostgreSQL Authentication
summary
pg_hba.conf is where authentication actually happens and its dozen methods reflect historical trade‑offs: original trust/peer Unix assumptions, MD5 hashes that later prove weak, and SCRAM becoming default in SCRAM-SHA (Postgres 14) to avoid sending plaintext. Enterprises add LDAP or Kerberos/GSSAPI; certificate auth works but breaks on secure distribution and revocation. Cloud providers push PostgreSQL 18 token protocol and short‑lived tokens (seconds to hours) that simplify rotation; choose short‑lived identities and plan revocation.
AI-written summary · about
chapters (10)
- 0:00Music & introduction
- 1:00The problem in PostgreSQL authentication
- 3:06The history of PostgreSQL authentication
- 8:42The difficulty of passwords
- 9:48Enterprise authentication: LDAP & Kerberos
- 11:32Certificate-based authentication
- 14:41Token-based authentication in the cloud era
- 16:58Choosing an authentication method
- 18:26Common mistakes in authentication
- 20:22Key takeaways & closing
related talks
54mConfiguration and Authentication
35mSecuring PostgreSQL From External Attack
48mAdvanced Authentication and Encrypted Connections
46mGet Your Insecure PostgreSQL Passwords to SCRAM!
07mAll about Postgres security
32mEnhancing Security in PostgreSQL
35mThe Three Musketeers (Authentication, Authorization, and Accounting)
50mSecuring PostgreSQL From External Attack