search

MigOpsRepos / credcheck

PostgreSQL plain credential checker
MIT License
57 stars 5 forks source link

Support for encrypted passwords #6

Closed umairshahid closed 1 year ago

umairshahid commented 2 years ago

This comes in from an interview with a customer, they need support for encrypted passwords as part of regulatory compliance.

darold commented 2 years ago

It is not possible to know the plain text value of an encrypted password passed to a CREATE or ALTER ROLE statement. The credential strength must be checked by the utility used to generate the encrypted password.

jobinau commented 2 years ago

@umairshahid , Technically it is impossible for the server to know the password strength if it is encrypted on the client-side. Sad, but it defeats some of the good practices and feature provided in psql

postgres=# \password abc  
Enter new password:  
Enter it again:   
ERROR:  password type is not a plain text