From: Rui DeSousa <rui.desousa@icloud.com>
To: Kashif Zeeshan <kashi.zeeshan@gmail.com>
Cc: James Pang <jamespang886@gmail.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: password_rollover_time like Oracle
Date: Thu, 20 Jun 2024 20:53:02 -0400
Message-ID: <A359265B-7271-4C12-9CBB-37BDE6814EB2@icloud.com> (raw)
In-Reply-To: <CAAPsdheJ=7pwq0+GK1hiiLzeEzzp4dH1rK5doqqM8+EF_1jYZA@mail.gmail.com>
References: <CAHgTRff_h6d_dzQ4dNx+=Qs-misrSsHUNXzZYH+QGK193vJesw@mail.gmail.com>
<CAAPsdheJ=7pwq0+GK1hiiLzeEzzp4dH1rK5doqqM8+EF_1jYZA@mail.gmail.com>
> On Jun 20, 2024, at 2:43 AM, Kashif Zeeshan <kashi.zeeshan@gmail.com> wrote:
>
> Hi James
>
> There is no such functionality in PG.
>
> Thanks
> Kashif Zeeshan
>
>
> On Thu, Jun 20, 2024 at 11:10 AM James Pang <jamespang886@gmail.com <mailto:jamespang886@gmail.com>> wrote:
> Hi,
> We used to use "password_rollover_time" = 7days with Oracle database, so when we change password of a user, that allow 7days for both old and new passwords to login database. application can rolling change their database user passwords in 7days. That did help application to change their database user passwords.
> we use Postgresql v14, is there similar feature for Postgresql ?
>
> Thanks,
>
> James
It can be achieved by using roles and rolling accounts. Then the application would need to update username/password before it expires to the new account/password. The only difference is rather than changing just the password the account information also changes; however, no permissions are ever given directly to the user account. I’ve been in an environments that have use this approach — Just remember to create the new user and update the username/password before they expire.
i.e.
approle (A role with no login and all the application permissions)
create user appuser202406 with inherit in role approle valid until '07/01/2024' encrypted password 'xxxx’;
create user appuser202407 with inherit in role approle valid until '08/01/2024' encrypted password ‘yyyy';=
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: rui.desousa@icloud.com, kashi.zeeshan@gmail.com, jamespang886@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: password_rollover_time like Oracle
In-Reply-To: <A359265B-7271-4C12-9CBB-37BDE6814EB2@icloud.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox