Date: Thu, 9 Nov 2023 16:42:18 -0500
From: Bruce Momjian <bruce@momjian.us>
To: greatvovan@gmail.com, pgsql-docs@lists.postgresql.org
Subject: Re: User mapping security
Message-ID: <ZU1SOvgnwbBawgzN@momjian.us>
References: <156324246053.1191.5972769566826595079@wrigleys.postgresql.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="Z0ar3iXrjdIFtH0+"
Content-Disposition: inline
In-Reply-To: <156324246053.1191.5972769566826595079@wrigleys.postgresql.org>
Archived-At: 
 <https://www.postgresql.org/message-id/ZU1SOvgnwbBawgzN%40momjian.us>
Precedence: bulk


--Z0ar3iXrjdIFtH0+
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Tue, Jul 16, 2019 at 02:01:00AM +0000, PG Doc comments form wrote:
> The following documentation comment has been logged on the website:
> 
> Page: https://www.postgresql.org/docs/10/postgres-fdw.html
> Description:
> 
> Regarding the documentation pages
> https://www.postgresql.org/docs/10/postgres-fdw.html?origin_team=T02HEPYKQ
> and https://www.postgresql.org/docs/10/sql-createusermapping.html
> 
> I suppose it should be warned on the pages that foreign credentials with be
> stored as simple text and will be available for viewing in pg_user_mappings.

I know this is four years old, but the attached patch documents it.  I
don't think postgresql-fdw needs it since it relies on user mapping and
discourages passwords in the connection string.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Only you can decide what is important to you.

--Z0ar3iXrjdIFtH0+
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename="usermap.diff"

diff --git a/doc/src/sgml/ref/create_user_mapping.sgml b/doc/src/sgml/ref/create_user_mapping.sgml
index 55debd5401..e93bfe48f6 100644
--- a/doc/src/sgml/ref/create_user_mapping.sgml
+++ b/doc/src/sgml/ref/create_user_mapping.sgml
@@ -92,7 +92,11 @@ CREATE USER MAPPING [ IF NOT EXISTS ] FOR { <replaceable class="parameter">user_
       This clause specifies the options of the user mapping.  The
       options typically define the actual user name and password of
       the mapping.  Option names must be unique.  The allowed option
-      names and values are specific to the server's foreign-data wrapper.
+      names and values are specific to the server's foreign-data
+      wrapper.  Option values, including passwords, are visible in the
+      <link
+      linkend="catalog-pg-user-mapping"><structname>pg_user_mapping</structname></link>
+      system view.
      </para>
     </listitem>
    </varlistentry>

--Z0ar3iXrjdIFtH0+--