Re: SASL OTP and syncrepl

Pierangelo Masarati masarati@aero.polimi.it wrote:

  - wait for replication to complete 

before authentication can continue.

One problem:

If we do that, authentication cannot take place if the master or a replica is down. That defeats the purpose of setting up replicas to prevent failures.

IMO there is a trade off between reliability and security here. We can either (1) redirect the client to the master (lower availability, better security since no replay can happen at any time), or (2) accept the authentication locally and send the update to the master afterwards (more reliable. less secure)