Message-ID: <7fa8483c9d3d1fdc12c3b6aba1eb637ce366b370.camel@cybertec.at>
Subject: Re: Upgrading password encryption from md5 to scram-sh-256
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Nikhil Shetty <nikhil.dba04@gmail.com>, pgsql-admin@postgresql.org
Date: Fri, 28 May 2021 16:29:10 +0200
In-Reply-To: 
 <CAFpL5VytCu6h4n1hnaRS1BYTNW8uv5jx_FDERwssL_vCNYAfzw@mail.gmail.com>
References: 
	<CAFpL5VytCu6h4n1hnaRS1BYTNW8uv5jx_FDERwssL_vCNYAfzw@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.36.5 (3.36.5-2.fc32) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/7fa8483c9d3d1fdc12c3b6aba1eb637ce366b370.camel%40cybertec.at>
Precedence: bulk

On Fri, 2021-05-28 at 18:57 +0530, Nikhil Shetty wrote:
> As per documentation, for upgrading password encryption from md5 to scram-sha-256,
>  we have to set password_encryption to scram-sha-256, reset the user password and
> then change in pg_hba.conf.
> 
> Is there any other way to do this without changing the password? if there are a lot
>  of login users in the database it becomes difficult and it may incur downtime as well.
> 
> I see there is a way the users can do it by themselves but still will incur some downtime.

There is no other way than for the users to set the password again, because PostgreSQL
doesn't know the original password.

You can leave the "pg_hba.conf" entry set to "md5", then users can login with
scram-sha-256 passwords as well as with md5 passwords.  That can make the transition
painless.

Yours,
Laurenz Albe
-- 
Cybertec | https://www.cybertec-postgresql.com