From: Joe Conway <mail@joeconway.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Add new function, PQchangePassword(), to libpq
Date: Tue, 09 Jan 2024 14:17:22 +0000
Message-ID: <E1rNCuw-000d1W-0x@gemulon.postgresql.org> (raw)
Add new function, PQchangePassword(), to libpq
Essentially this moves the non-interactive part of psql's "\password"
command into an exported client function. The password is not sent to the
server in cleartext because it is "encrypted" (in the case of scram and md5
it is actually hashed, but we have called these encrypted passwords for a
long time now) on the client side. This is good because it ensures the
cleartext password is never known by the server, and therefore won't end up
in logs, pg_stat displays, etc.
In other words, it exists for the same reason as PQencryptPasswordConn(), but
is more convenient as it both builds and runs the "ALTER USER" command for
you. PQchangePassword() uses PQencryptPasswordConn() to do the password
encryption. PQencryptPasswordConn() is passed a NULL for the algorithm
argument, hence encryption is done according to the server's
password_encryption setting.
Also modify the psql client to use the new function. That provides a builtin
test case. Ultimately drivers built on top of libpq should expose this
function and its use should be generally encouraged over doing ALTER USER
directly for password changes.
Author: Joe Conway
Reviewed-by: Tom Lane
Discussion: https://postgr.es/m/flat/b75955f7-e8cc-4bbd-817f-ef536bacbe93%40joeconway.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/a7be2a6c262d5352756d909b29c419ea5e5fa1d9
Modified Files
--------------
doc/src/sgml/libpq.sgml | 39 +++++++++++++++++++
src/bin/psql/command.c | 20 ++--------
src/interfaces/libpq/exports.txt | 1 +
src/interfaces/libpq/fe-auth.c | 81 ++++++++++++++++++++++++++++++++++++++++
src/interfaces/libpq/libpq-fe.h | 1 +
5 files changed, 125 insertions(+), 17 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: mail@joeconway.com, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add new function, PQchangePassword(), to libpq
In-Reply-To: <E1rNCuw-000d1W-0x@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox