From: Tom Lane <tgl@sss.pgh.pa.us>
To: Gilles Darold <gilles@migops.com>
cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: Pasword expiration warning
In-reply-to: <129bcfbf-47a6-e58a-190a-62fc21a17d03@migops.com>
References: <129bcfbf-47a6-e58a-190a-62fc21a17d03@migops.com>
Comments: In-reply-to Gilles Darold <gilles@migops.com>
	message dated "Fri, 19 Nov 2021 15:49:37 +0100"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3046421.1637337334.1@sss.pgh.pa.us>
Date: Fri, 19 Nov 2021 10:55:34 -0500
Message-ID: <3046422.1637337334@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3046422.1637337334%40sss.pgh.pa.us>
Precedence: bulk

Gilles Darold <gilles@migops.com> writes:
> Now that the security policy is getting stronger, it is not uncommon to 
> create users with a password expiration date (VALID UNTIL).

TBH, I thought people were starting to realize that forced password
rotations are a net security negative.  It's true that a lot of
places haven't gotten the word yet.

> I'm wondering if we might be interested in having this feature in psql? 

This proposal kind of seems like a hack, because
(1) not everybody uses psql
(2) psql can't really tell whether rolvaliduntil is relevant.
    (It can see whether the server demanded a password, but
    maybe that went to LDAP or some other auth method.)

That leads me to wonder about server-side solutions.  It's easy
enough for the server to see that it's used a password with an
expiration N days away, but how could that be reported to the
client?  The only idea that comes to mind that doesn't seem like
a protocol break is to issue a NOTICE message, which doesn't
seem like it squares with your desire to only do this interactively.
(Although I'm not sure I believe that's a great idea.  If your
application breaks at 2AM because its password expired, you
won't be any happier than if your interactive sessions start to
fail.  Maybe a message that would leave a trail in the server log
would be best after all.)

> Default value is 0 like today no warning at all.

Off-by-default is pretty much guaranteed to not help most people.

			regards, tom lane