Date: Sat, 8 May 2021 09:37:42 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Vipin Madhusoodanan <vipin.madhusoodanan@gmail.com>,
	Vijaykumar Jain <vijaykumarjain.github@gmail.com>,
	pgsql-admin@lists.postgresql.org, Holger Jakobs <holger@jakobs.com>
Subject: Re: Query on User account password change details
Message-ID: <20210508133742.GA27049@momjian.us>
References: 
 <CAPOO3u4cxoCmJsXJaMHCLavecb-Bc77=qh=dfQN+bbYJ6gneWA@mail.gmail.com>
 <90B6B3A1-BB95-4D69-99EF-D86C0A859431@jakobs.com>
 <CAM+6J95bx6yUwv-rw4Cxft68YkxiQHKWDOW0LLNbymbt6538Kw@mail.gmail.com>
 <CAPOO3u7Y=_suBOaJuZZdB=rMYRtekQZO8=ZsEatDoR+cqZb3DQ@mail.gmail.com>
 <CAPOO3u4-McoLHk06fR6h6EhYMjarK7aNX-tLXLyq927hG-SByQ@mail.gmail.com>
 <6bc4ea2d4055691bc3e309aa1488721da9c8c2c0.camel@cybertec.at>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <6bc4ea2d4055691bc3e309aa1488721da9c8c2c0.camel@cybertec.at>
User-Agent: Mutt/1.10.1 (2018-07-13)
Archived-At: 
 <https://www.postgresql.org/message-id/20210508133742.GA27049%40momjian.us>
Precedence: bulk

On Sat, May  8, 2021 at 05:44:52AM +0200, Laurenz Albe wrote:
> On Fri, 2021-05-07 at 15:47 -0500, Vipin Madhusoodanan wrote:
> > Can someone help with suggestions or ideas for a workaround to achieve this? 
> > 
> > > > > > Please advise on the possibilities to retrieve “last password change date”  for a PostgreSQL user account.
> > > > > >  We have an audit requirement to identify the password change details for local PostgreSQL user accounts.
> 
> You cannot do that unless you want to modify PostgreSQL.
> 
> For requirements like this, the recommendation is *not* to use passwords
> in the database for authentication.  Use one of the other authentication
> methods that uses an external authority.
> 
> Identity management systems specialize in that kind of thing, and you may
> be able to get that information from there.

Here is a blog entry about using cerrificate authenticaiton and rotating them:

	https://momjian.us/main/blogs/pgblog/2020.html#July_17_2020

The certificates must have expiration dates.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  If only the physical world exists, free will is an illusion.