[Feature Request] SCRAM functions are in the internal schema

[AlekSi]

Purpose of the feature.

FerretDB uses the following functions for authentication:

• documentdb_api_internal.scram_sha256_get_salt_and_iterations
• documentdb_api_internal.authenticate_with_scram_sha256

They are in the internal schema. They probably should be in the documentdb_api.

Describe the solution you'd like

Those functions are in the non-internal schema, documented and supported.

Describe alternatives you've considered

Continue using internal schema.

Additional context

None.

[safern]

Hello @AlekSi -- these are utility functions that probably shouldn't even have landed on the internal schema nor the public one. At the end this is more of a wire protocol problem rather than the extension's functionality as PG provides auth already.

However, we could have a formal proposal with the benefits of it vs implementing your own wire protocol auth and discuss further here, but we are still not convinced this should be public and broadly used/maintained by us for customer to do their auth.

Would you mind expanding on why FerretDB needs to use these APIs, the motivation behind it and examples?

FYI: @visridha

[safern]

@AlekSi were debating that this might not belong in documentdb schema itself but instead in a separate utility schema or even a separate utility extension for gateways that implement the wire protocol.

We will review this still figuring out how to do public reviews.

[AlekSi]

I would like to point out that the blog post explicitly mentions

A fully functional authentication mechanism including SCRAM (Salted Challenge Response Authentication Mechanism) authentication

As for whatever it should be in DocumentDB at all… We implemented all possible versions of that during v1 development. First, we relied on PostgreSQL only, but it had a limitation of supporting the PLAIN mechanism only, passing a password in the plaintext (and that's not very well supported by MongoDB drivers). Then we added experimental support for SCRAM by handling authentication ourselves, but having two sets of credentials (in FerretDB and PostgreSQL) is very confusing, and also makes it impossible to support authorization down the road. Having SCRAM hooks in the extension really helps us.