pub struct ScramClient { /* private fields */ }Expand description
A SCRAM-SHA-256 exchange in progress.
Implementations§
Source§impl ScramClient
impl ScramClient
Sourcepub fn new(password: &str) -> Result<Self, Error>
pub fn new(password: &str) -> Result<Self, Error>
Starts a new exchange. password is the cleartext password.
The startup message already carries the username, so it is not repeated in the SCRAM message (matching other PostgreSQL clients).
Sourcepub fn with_max_iterations(
password: &str,
max_iterations: u32,
) -> Result<Self, Error>
pub fn with_max_iterations( password: &str, max_iterations: u32, ) -> Result<Self, Error>
Like ScramClient::new, but caps the server-supplied PBKDF2
iteration count at max_iterations instead of the default.
§Errors
Returns Error::Auth when the password cannot be SASLprep’d (it
contains a prohibited control character).
Sourcepub fn client_first_message(&self) -> String
pub fn client_first_message(&self) -> String
The full initial response: GS2 header n,, followed by the
client-first-message-bare.
Sourcepub fn parse_server_first_message(&mut self, data: &[u8]) -> Result<(), Error>
pub fn parse_server_first_message(&mut self, data: &[u8]) -> Result<(), Error>
Parses the server-first-message and derives the salted password.
§Errors
Returns Error::Auth when the message is malformed, when the server
nonce does not extend the client nonce, when the iteration count is
outside 1..=MAX_SCRAM_ITERATIONS, or when the salt is oversized.
Sourcepub fn build_client_final_message(&self) -> Result<Vec<u8>, Error>
pub fn build_client_final_message(&self) -> Result<Vec<u8>, Error>
Builds the client-final-message.
§Errors
Returns Error::Auth when called before
parse_server_first_message.
Sourcepub fn parse_server_final_message(&self, data: &[u8]) -> Result<(), Error>
pub fn parse_server_final_message(&self, data: &[u8]) -> Result<(), Error>
Verifies the server-final-message (v=) against the expected signature.
§Errors
Returns Error::Auth when the server rejects the exchange (e=),
when the signature is missing or malformed, or when it does not match
the expected value (a proxy that does not know the password).