diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/commands/user.c | 2 | ||||
| -rw-r--r-- | src/backend/utils/misc/guc.c | 11 | ||||
| -rw-r--r-- | src/backend/utils/misc/postgresql.conf.sample | 2 | ||||
| -rw-r--r-- | src/bin/initdb/initdb.c | 21 | ||||
| -rw-r--r-- | src/test/regress/expected/password.out | 5 | ||||
| -rw-r--r-- | src/test/regress/sql/password.sql | 3 |
6 files changed, 18 insertions, 26 deletions
diff --git a/src/backend/commands/user.c b/src/backend/commands/user.c index 1ef00d6e895..9ce9a669218 100644 --- a/src/backend/commands/user.c +++ b/src/backend/commands/user.c @@ -43,7 +43,7 @@ Oid binary_upgrade_next_pg_authid_oid = InvalidOid; /* GUC parameter */ -int Password_encryption = PASSWORD_TYPE_MD5; +int Password_encryption = PASSWORD_TYPE_SCRAM_SHA_256; /* Hook to check passwords in CreateRole() and AlterRole() */ check_password_hook_type check_password_hook = NULL; diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c index 17c15348efc..28b2fc72d64 100644 --- a/src/backend/utils/misc/guc.c +++ b/src/backend/utils/misc/guc.c @@ -463,18 +463,9 @@ static const struct config_enum_entry plan_cache_mode_options[] = { {NULL, 0, false} }; -/* - * password_encryption used to be a boolean, so accept all the likely - * variants of "on", too. "off" used to store passwords in plaintext, - * but we don't support that anymore. - */ static const struct config_enum_entry password_encryption_options[] = { {"md5", PASSWORD_TYPE_MD5, false}, {"scram-sha-256", PASSWORD_TYPE_SCRAM_SHA_256, false}, - {"on", PASSWORD_TYPE_MD5, true}, - {"true", PASSWORD_TYPE_MD5, true}, - {"yes", PASSWORD_TYPE_MD5, true}, - {"1", PASSWORD_TYPE_MD5, true}, {NULL, 0, false} }; @@ -4733,7 +4724,7 @@ static struct config_enum ConfigureNamesEnum[] = NULL }, &Password_encryption, - PASSWORD_TYPE_MD5, password_encryption_options, + PASSWORD_TYPE_SCRAM_SHA_256, password_encryption_options, NULL, NULL, NULL }, diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index ac02bd0c00a..3a25287a391 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -88,7 +88,7 @@ # - Authentication - #authentication_timeout = 1min # 1s-600s -#password_encryption = md5 # md5 or scram-sha-256 +#password_encryption = scram-sha-256 # scram-sha-256 or md5 #db_user_namespace = off # GSSAPI using Kerberos diff --git a/src/bin/initdb/initdb.c b/src/bin/initdb/initdb.c index 5a787681f96..786672b1b65 100644 --- a/src/bin/initdb/initdb.c +++ b/src/bin/initdb/initdb.c @@ -1204,12 +1204,18 @@ setup_config(void) "#update_process_title = off"); #endif - if (strcmp(authmethodlocal, "scram-sha-256") == 0 || - strcmp(authmethodhost, "scram-sha-256") == 0) + /* + * Change password_encryption setting to md5 if md5 was chosen as an + * authentication method, unless scram-sha-256 was also chosen. + */ + if ((strcmp(authmethodlocal, "md5") == 0 && + strcmp(authmethodhost, "scram-sha-256") != 0) || + (strcmp(authmethodhost, "md5") == 0 && + strcmp(authmethodlocal, "scram-sha-256") != 0)) { conflines = replace_token(conflines, - "#password_encryption = md5", - "password_encryption = scram-sha-256"); + "#password_encryption = scram-sha-256", + "password_encryption = md5"); } /* @@ -2373,12 +2379,7 @@ check_need_password(const char *authmethodlocal, const char *authmethodhost) strcmp(authmethodhost, "scram-sha-256") == 0) && !(pwprompt || pwfilename)) { - pg_log_error("must specify a password for the superuser to enable %s authentication", - (strcmp(authmethodlocal, "md5") == 0 || - strcmp(authmethodlocal, "password") == 0 || - strcmp(authmethodlocal, "scram-sha-256") == 0) - ? authmethodlocal - : authmethodhost); + pg_log_error("must specify a password for the superuser to enable password authentication"); exit(1); } } diff --git a/src/test/regress/expected/password.out b/src/test/regress/expected/password.out index 2b852aa324d..7c84c9da337 100644 --- a/src/test/regress/expected/password.out +++ b/src/test/regress/expected/password.out @@ -5,13 +5,14 @@ SET password_encryption = 'novalue'; -- error ERROR: invalid value for parameter "password_encryption": "novalue" HINT: Available values: md5, scram-sha-256. -SET password_encryption = true; -- ok +SET password_encryption = true; -- error +ERROR: invalid value for parameter "password_encryption": "true" +HINT: Available values: md5, scram-sha-256. SET password_encryption = 'md5'; -- ok SET password_encryption = 'scram-sha-256'; -- ok -- consistency of password entries SET password_encryption = 'md5'; CREATE ROLE regress_passwd1 PASSWORD 'role_pwd1'; -SET password_encryption = 'on'; CREATE ROLE regress_passwd2 PASSWORD 'role_pwd2'; SET password_encryption = 'scram-sha-256'; CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3'; diff --git a/src/test/regress/sql/password.sql b/src/test/regress/sql/password.sql index 1e7e19eafa8..98f49916e5d 100644 --- a/src/test/regress/sql/password.sql +++ b/src/test/regress/sql/password.sql @@ -4,14 +4,13 @@ -- Tests for GUC password_encryption SET password_encryption = 'novalue'; -- error -SET password_encryption = true; -- ok +SET password_encryption = true; -- error SET password_encryption = 'md5'; -- ok SET password_encryption = 'scram-sha-256'; -- ok -- consistency of password entries SET password_encryption = 'md5'; CREATE ROLE regress_passwd1 PASSWORD 'role_pwd1'; -SET password_encryption = 'on'; CREATE ROLE regress_passwd2 PASSWORD 'role_pwd2'; SET password_encryption = 'scram-sha-256'; CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3'; |