Date: Thu, 6 May 2021 16:10:43 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Vipin Madhusoodanan <vipin.madhusoodanan@gmail.com>
Cc: "pgsql-admin@lists.postgresql.org" <pgsql-admin@lists.postgresql.org>
Subject: Re: Query on User account password change details
Message-ID: <20210506201043.GA10431@momjian.us>
References: 
 <CAPOO3u4cxoCmJsXJaMHCLavecb-Bc77=qh=dfQN+bbYJ6gneWA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: 
 <CAPOO3u4cxoCmJsXJaMHCLavecb-Bc77=qh=dfQN+bbYJ6gneWA@mail.gmail.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
Archived-At: 
 <https://www.postgresql.org/message-id/20210506201043.GA10431%40momjian.us>
Precedence: bulk

On Thu, May  6, 2021 at 02:52:00PM -0500, Vipin Madhusoodanan wrote:
> Hi Team,
> 
> Please advise on the possibilities to retrieve “last password change date”  for
> a PostgreSQL user account. We have an audit requirement to identify the
> password change details for local PostgreSQL user accounts. We are able to
> track AD users using AD Group Policy, but unable to fetch these details for
> local user accounts. Tried to explore pg_users and pg_shadow catalog views, but
> this information was not available. 

Yep, it's not available.  If you are authenticating Postgres using AD,
you don't really change the password in Postgres, right?  You can just
check the AD date.  I don't think triggers work on system tables, so I
don't think that is an option.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  If only the physical world exists, free will is an illusion.