Error:'authentication exchange unsuccessful' when connecting to Postgresql14

[jianmaikj]

Is there an existing issue for this?

• [X] I have searched the existing issues

Kong version ($ kong version)

3.4.0

Current Behavior

I'm installing Kong through docker and connecting to Postgresql 14 on the host, but get this error: Error: [PostgreSQL error] failed to retrieve PostgreSQL server_version_num: authentication exchange unsuccessful when I run the following command:

docker run -it --rm --network=host -e "KONG_DATABASE=postgres" -e "KONG_PG_HOST=127.0.0.1" -e "KONG_PG_PORT=5432" -e "KONG_PG_USER=kong" -e "KONG_PG_PASSWORD=12345678" -e "KONG_PG_DATABASE=kong" kong:latest kong migrations bootstrap;

BUT it works fine with Postgresql 13 or md5 mode

Expected Behavior

No response

Steps To Reproduce

1. Operating system: Unbuntu, Database: Postgres 14(non-docker container)
2. Commands:

   docker pull kong

   docker run -it --rm --network=host -e "KONG_DATABASE=postgres" -e "KONG_PG_HOST=127.0.0.1" -e "KONG_PG_PORT=5432" -e "KONG_PG_USER=kong" -e "KONG_PG_PASSWORD=12345678" -e "KONG_PG_DATABASE=kong" kong:latest kong migrations bootstrap;

3. See error: [PostgreSQL error] failed to retrieve PostgreSQL server_version_num: authentication exchange unsuccessful

Anything else?

No response

[StarlightIbuki]

Please refer to https://docs.konghq.com/gateway/latest/install/linux/debian/#:~:text=Note%3A%20Older%20versions%20of%20PostgreSQL%20use%20ident%20authentication%20by%20default%2C%20newer%20versions%20(PSQL%2010%2B)%20use%20scram%2Dsha%2D256.%20To%20allow%20the%20kong%20user%20to%20communicate%20with%20the%20database%20locally%2C%20change%20the%20authentication%20method%20to%20md5%20by%20modifying%20the%20PostgreSQL%20configuration%20file.

Note: Older versions of PostgreSQL use ident authentication by default, newer versions (PSQL 10+) use scram-sha-256. To allow the kong user to communicate with the database locally, change the authentication method to md5 by modifying the PostgreSQL configuration file.

[jianmaikj]

Please refer to https://docs.konghq.com/gateway/latest/install/linux/debian/#:~:text=Note%3A%20Older%20versions%20of%20PostgreSQL%20use%20ident%20authentication%20by%20default%2C%20newer%20versions%20(PSQL%2010%2B)%20use%20scram%2Dsha%2D256.%20To%20allow%20the%20kong%20user%20to%20communicate%20with%20the%20database%20locally%2C%20change%20the%20authentication%20method%20to%20md5%20by%20modifying%20the%20PostgreSQL%20configuration%20file.

Note: Older versions of PostgreSQL use ident authentication by default, newer versions (PSQL 10+) use scram-sha-256. To allow the kong user to communicate with the database locally, change the authentication method to md5 by modifying the PostgreSQL configuration file.

thank you, so I have to use md5? is there any plan to support scram-sha-256?

[bungle]

Just a note here (not sure if it is related): https://github.com/leafo/pgmoon/issues/133

But it looks like we are using our own fork: https://github.com/Kong/pgmoon#pgmoon

[hanshuebner]

Create internal ticket KAG-2600

[nowNick]

Hey @jianmaikj , Could you share your postgres config? From my research it looks like scram-sha-256 should be supported on the kong side and we need to update the docs. Reasons for that:

• our pgmoon fork should support scram-sha-256 from version 1.13.0 as it's described in it's changelog (https://github.com/Kong/pgmoon#changelog)
• In Kong 3.4.0 we're using pgmoon in version 1.16.2: https://github.com/Kong/kong/blob/3.4.0/kong-3.4.0-0.rockspec#L25
• The commit in Kong (from nearly 2 years ago) that bumps pgmoon from version 1.12.0 to 1.13.0 specifically states that it should support right now scram-sha-256 : https://github.com/Kong/kong/commit/99c1276a109a2c0e753bd03f2ad6b6b517e6ea65

Apart from that I tried to replicate your issue with various postgres configuration and I was not able to. Everytime I ran kong migrations bootstrap - it worked. It's possible that the issue reported on original pgmoon repo that bugs scram-sha-256 is also present in our fork, though I could not replicate it either.

Therefore to move this issue forward could you share your postgres config or a docker-compose file that reproduces this issue?

[nowNick]

Also - could you double check the password? The only instance when I was able to replicate the error you reported was when I intentionally used wrong password for kong. Then I got:

Postgres logs:

FATAL:  password authentication failed for user "kong"
DETAIL:  Connection matched file "/var/lib/postgresql/data/pg_hba.conf" line 128: "host all all all scram-sha-256"

Kong logs:

Error: [PostgreSQL error] failed to retrieve PostgreSQL server_version_num: authentication exchange unsuccessful

But when I changed the password to the correct one then kong connected without any issues.

[github-actions[bot]]

This issue is marked as stale because it has been open for 14 days with no activity.

[github-actions[bot]]

Dear contributor,

We are automatically closing this issue because it has not seen any activity for three weeks. We're sorry that your issue could not be resolved. If any new information comes up that could help resolving it, please feel free to reopen it.

Your contribution is greatly appreciated!

Please have a look our pledge to the community for more information.

Sincerely, Your Kong Gateway team

[Rishav-Roushan-Infrrd]

│ Run with --v (verbose) or --vv (debug) for more details │ │ waiting for db │ │ Error: don't know how to auth: 10