Subject: Re: Pasword expiration warning
To: Andrew Dunstan <andrew@dunslane.net>,
 "Bossart, Nathan" <bossartn@amazon.com>, Gilles Darold <gilles@migops.com>,
 Tom Lane <tgl@sss.pgh.pa.us>
Cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>
References: <129bcfbf-47a6-e58a-190a-62fc21a17d03@migops.com>
 <3046422.1637337334@sss.pgh.pa.us>
 <a776f2d0-7ef8-f734-48b7-2aa383f41b2b@migops.com>
 <C7B3C461-2A44-4A73-B71F-933AD2DC3C6A@amazon.com>
 <3ea14054-af0c-3f21-0ced-04c896438bdc@dunslane.net>
From: Gilles Darold <gilles@migops.com>
Message-ID: <08e09a01-5762-3b2e-1fa7-513478ab7394@migops.com>
Date: Sun, 21 Nov 2021 10:49:57 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.14.0
MIME-Version: 1.0
In-Reply-To: <3ea14054-af0c-3f21-0ced-04c896438bdc@dunslane.net>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Content-Language: fr
Archived-At: 
 <https://www.postgresql.org/message-id/08e09a01-5762-3b2e-1fa7-513478ab7394%40migops.com>
Precedence: bulk

Le 20/11/2021 à 14:48, Andrew Dunstan a écrit :
> On 11/19/21 19:17, Bossart, Nathan wrote:
>> On 11/19/21, 7:56 AM, "Tom Lane" <tgl@sss.pgh.pa.us> wrote:
>>> That leads me to wonder about server-side solutions.  It's easy
>>> enough for the server to see that it's used a password with an
>>> expiration N days away, but how could that be reported to the
>>> client?  The only idea that comes to mind that doesn't seem like
>>> a protocol break is to issue a NOTICE message, which doesn't
>>> seem like it squares with your desire to only do this interactively.
>>> (Although I'm not sure I believe that's a great idea.  If your
>>> application breaks at 2AM because its password expired, you
>>> won't be any happier than if your interactive sessions start to
>>> fail.  Maybe a message that would leave a trail in the server log
>>> would be best after all.)
>> I bet it's possible to use the ClientAuthentication_hook for this.  In
>> any case, I agree that it probably belongs server-side so that other
>> clients can benefit from this.
>>
> +1 for a server side solution. The people most likely to benefit from
> this are the people least likely to be using psql IMNSHO.


Ok, I can try to implement something at server side using a NOTICE message.


-- 
Gilles Darold