Re: SCRAM pass-through authentication for postgres_fdw

On Fri Aug 8, 2025 at 3:31 PM -03, Peter Eisentraut wrote:
>> I've also made some tests by using the use_scram_passthrough option on
>> foreign server and if a bgworker try to use a foreign table that has
>> this option associated with the foreign server the connection will fail
>> because we don't have the MyProcPort and the password. To make it work
>> the password is required on USER MAPPING options. I think that this
>> limitation should be documented, see patch attached.
>
> The fact that SCRAM pass-through doesn't work in a background worker is
> arguably implied by the existing paragraph that says that you need to
> use SCRAM on the client side.  But I think there is opportunity to
> clarify that further.  The documentation currently doesn't say what
> happens if the client doesn't use SCRAM.  The code then just ignores the
> use_scram_passthrough setting, and your documentation proposal also
> suggests that it would fall back to the password provided in the user
> mapping.  But this could be documented more explicitly, I think.
>
I agree, thanks for the comments! What do you think about the following?

+      <para>
+       If the incoming connection to the FDW instance does not use SCRAM,
+       <literal>use_scram_passthrough</literal> is ignored and authentication
+       will instead use the password from the user mapping, if one is provided.
+      </para>

--
Matheus Alcantara