From: Holger Jakobs <holger@jakobs.com>
To: pgsql-admin@lists.postgresql.org
Subject: Re: Upgrading password encryption from md5 to scram-sh-256
Date: Sat, 29 May 2021 10:10:05 +0200
Message-ID: <8eb90d2f-2a3f-8da8-a03e-124105156678@jakobs.com> (raw)
In-Reply-To: <CAFpL5Vwv06hv-QKB51_OLn3JYevp4dwfJQVaXk-NRame-c7+Cg@mail.gmail.com>
References: <CAFpL5VytCu6h4n1hnaRS1BYTNW8uv5jx_FDERwssL_vCNYAfzw@mail.gmail.com>
<EB91618C-D0EF-4653-A64F-1DD231F54E2D@excoventures.com>
<CAFpL5Vwv06hv-QKB51_OLn3JYevp4dwfJQVaXk-NRame-c7+Cg@mail.gmail.com>
Am 28.05.21 um 18:31 schrieb Nikhil Shetty:
> Hi,
>
> Thank you for your feedback Jonathan, Laurenz and Holger. I am
> thinking of using the below approach which will give users more
> control of when to change "application-user" password.
>
> Is there any drawback if the user uses below steps to change their
> password?
>
> 1. alter user set password_encryption to 'scram-sha-256' 2. In a new
> session, users can change their passwords
>
> Finally, once all users have changed password, set password_encryption
> at instance level, make changes in pg_hba and reload.
>
> To use the same password as before, we can do "alter user <username>
> password <oldpassword>", so this will change to scram-sha-256 but no
> changes in application code.
>
> Thanks and Regards,
> Nikhil
>
Yes, that's exactly the way to go.
--
Holger Jakobs, Bergisch Gladbach, Tel. +49-178-9759012
Attachments:
OpenPGP_signature (application/pgp-signature, 202B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: holger@jakobs.com, pgsql-admin@lists.postgresql.org
Subject: Re: Upgrading password encryption from md5 to scram-sh-256
In-Reply-To: <8eb90d2f-2a3f-8da8-a03e-124105156678@jakobs.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox