Feedback-ID: i76984098:Fastmail
Message-ID: <49036afe-bfc0-48fc-9cef-971397efb426@aklaver.com>
Date: Thu, 27 Feb 2025 13:07:22 -0800
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: How to debug: password authentication failed for user
To: Greg Sabino Mullane <htamfids@gmail.com>, Tom Lane <tgl@sss.pgh.pa.us>
Cc: Alexander Farber <alexander.farber@gmail.com>,
 pgsql-general <pgsql-general@postgresql.org>
References: <CAADeyWjQNmfiQxaiRF0tkZ-kZyApPJT00xbmcMtj+oToSPGoWQ@mail.gmail.com>
 <056ebaa8-94bb-461d-905c-4035eab9ceac@aklaver.com>
 <CAADeyWjAUV8q_gdmEA=G4H5b66gaZopp42bTch27okCxPTS=hQ@mail.gmail.com>
 <d9cb5aab-417d-40b3-80f1-6c26acc7c839@aklaver.com>
 <2602739.1740681158@sss.pgh.pa.us>
 <CAKAnmm+VPxUkZ3jq7CtGoUT-gJ0NrFGTukyp8g_GvJsUxXiicg@mail.gmail.com>
Content-Language: en-US
From: Adrian Klaver <adrian.klaver@aklaver.com>
In-Reply-To: <CAKAnmm+VPxUkZ3jq7CtGoUT-gJ0NrFGTukyp8g_GvJsUxXiicg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: <https://www.postgresql.org/message-id/49036afe-bfc0-48fc-9cef-971397efb426%40aklaver.com>
Precedence: bulk

On 2/27/25 10:57, Greg Sabino Mullane wrote:
> On Thu, Feb 27, 2025 at 1:32 PM Tom Lane <tgl@sss.pgh.pa.us 
> <mailto:tgl@sss.pgh.pa.us>> wrote:
> 
>      > -c 'ALTER USER timeshift_user PASSWORD '"'"'timeshift_pass'"'"';'
>      > I am still trying to work out what that quoting is doing?
> 
> 
> That's standard for -x output for some versions of bash. FWIW, none of 
> the shells I had access to output it quite like that, but who knows what 
> shell the OP has. It's basically trying to stop the current ALTER USER 

I have to believe it is is related to this sequence:

docker build -f ./Dockerfile --build-arg PGPASSWORD=timeshift_pass

[...]

ARG PGPASSWORD

ENV POSTGRES_PASSWORD=$PGPASSWORD

[...]

ENV PGUSER=timeshift_user
ENV PGPASSWORD=$PGPASSWORD

[...]

RUN chmod +x ./01-create-database.sh ./04-alter-owner.sh

Where /01-create-database.sh has:

echo "Setting password for $PGUSER to $PGPASSWORD"
psql --username=postgres --dbname=postgres -c "ALTER USER $PGUSER 
PASSWORD '$PGPASSWORD';"

I just don't know enough about Docker to really understand all the hoops 
that are being jumped through in the above.


> statement, add a new single quote (but wrap it in double quotes!), then 
> start a new single-quoted string (the actual password). (So single, 
> double-single-double, single). Then do it all again at the end. It's 
> valid, and it should really be equivalent to PASSWORD 'timeshift_pass' 
> so it's hard to see what the problem is.
> 
> The fact that a manual ALTER ROLE cleared it up certainly suggests that 
> something is going wrong, however, and the SELECT rolpassword output 
> definitely means it had some password. A possibility is that somehow the 
> user password was already set and this particular statement was not run 
> (or run on a different cluster).
> 
> Another debug technique might be to have the shell script write the 
> ALTER USER command to a temp file, then slurp it in via psql -f. Then 
> you can cat that file as part of the script's output
> 
> Cheers,
> Greg
> 
> --
> Crunchy Data - https://www.crunchydata.com <https://www.crunchydata.com>
> Enterprise Postgres Software Products & Tech Support
> 

-- 
Adrian Klaver
adrian.klaver@aklaver.com