Subject: Re: How to debug: password authentication failed for user

From: Adrian Klaver <[email-masked]>
Date: Thu, 27 Feb 2025 09:20:01 -0800

On 2/27/25 08:46, Alexander Farber wrote:
> Good evening,

> My problem is that the local "trust" connection all work fine, but 
> remote connection from another pod in the AKS fails with:
> 
> PGPASSWORD=timeshift_pass psql --host=timeshiftservice --port=5432 
> --dbname=timeshift_database --username=timeshift_user --password
> Password: (here I enter the "timeshift_pass" and press enter)

Why set PGPASSWORD=timeshift_pass and use --password?

The password should be picked up from the env variable.

> psql: error: connection to server at "timeshiftservice" (10.0.120.194), 
> port 5432 failed: FATAL:  password authentication failed for user 
> "timeshift_user"
> 

> timeshift_database=# SELECT rolname, rolpassword FROM pg_authid WHERE 
> rolname = 'timeshift_user';
>      rolname     |                                                      
>          rolpassword
> 
> ----------------+---------------------------------------------------------------------------------------------------------------------------------------
>   timeshift_user | 
> SCRAM-SHA-256$4096:kQisEuaKSpuJK4kmpqoq2w==$nNNngQozh11kpDeW43ETrVUe1eNvKuKWvU/nb1etxEI=:537RuSYGRHEVJL4PyUxfAYIXNdA8cOp+QGnvNjKWWvQ=
> (1 row)

What happens if, when logged in via local, you do:

ALTER ROLE timeshift_user PASSWORD 'timeshift_pass';

and then try logging in via the remote connection?

Seeing if maybe the script is passing in or mangling the password.

> 
> Does anybody have an idea, what else could be wrong?
> 
> What could I check to make the remote connection as timeshift_user work?
> 
> Thank you
> Alex

-- 
Adrian Klaver
[email-masked]

---

From: Alexander Farber <[email-masked]>
Date: Thu, 27 Feb 2025 19:14:25 +0100

That seems to be the reason, thank you Adrian.

At first connecting from the other pod in the AKS cluster does not work:

$ PGPASSWORD=timeshift_pass psql --host=timeshiftservice --port=5432
--dbname=timeshift_database --username=timeshift_user
psql: error: connection to server at "timeshiftservice" (10.0.120.194),
port 5432 failed: FATAL:  password authentication failed for user "t
imeshift_user"

But once I connect to my PostgreSQL pod (or is it called "container"? I am
always confused by that) and run locally

$ psql -U postgres
psql (17.4)
Type "help" for help.

timeshift_database=# ALTER ROLE timeshift_user PASSWORD 'timeshift_pass';
ALTER ROLE

Then the connection from the other pod works immediately

---

From: Adrian Klaver <[email-masked]>
Date: Thu, 27 Feb 2025 10:21:04 -0800

On 2/27/25 10:14, Alexander Farber wrote:
> But once I connect to my PostgreSQL pod (or is it called "container"? I 
> am always confused by that) and run locally
> 
> $ psql -U postgres
> psql (17.4)
> Type "help" for help.
> 

My guess it has to do with:

-c 'ALTER USER timeshift_user PASSWORD '"'"'timeshift_pass'"'"';'

I am still trying to work out what that quoting is doing?