MIME-Version: 1.0
References: 
 <CAGB+Vh5Ed65gCmjJxCYguVoBoiDLePYDAeHMkb6-7PR-DFU-yQ@mail.gmail.com>
 <b951f0c9-b568-4889-8418-b01cf5a3cea2@timescale.com>
 <CAOuzzgpyFRFbskZW0uYwP4_r5NkFJywTurn0SQ+pkbcuuQchjw@mail.gmail.com>
 <CABwTF4Uih+xKc8o7W-Qmzo2Oc3BbvnY+JHzcZ-HG2vDzBQpf8w@mail.gmail.com>
 <20220701002034.GA9030@tamriel.snowman.net>
 <80684017-18c6-4116-9249-bb049ffe1ecf@amazon.com>
 <CAOuzzgq2j43X6vwF8LCPcPuKZ2gw0ZbF=CrsB6CmtEt1h2ci0g@mail.gmail.com>
 <CABwTF4XZO_429=QzZHt-1Q=KSCR2XjYG+xVy2p-PdPtun9tVdg@mail.gmail.com>
 <41a690ee7b030e6f41709bd39375641ef934e05f.camel@j-davis.com>
 <CABwTF4Xf5qJgeapUvT3fbU+Er9sVKBEihcj7pb9_A4c5u1NaZA@mail.gmail.com>
 <20231005190453.GB151257@nathanxps13>
 <2644f1886c7f5e2691f837de138ac5c3a09a68f6.camel@j-davis.com>
 <CABwTF4Xm97B3d2OkVWWpS1GBrRY_zJY8bkmQzmzYnXM0NU3w5Q@mail.gmail.com>
 <3ba7717e5493f3c3b45127457f540b7811f6f6e1.camel@j-davis.com>
 <CABwTF4VLNXvMLYHvySmGJOBRuO1h6L7Wq4JWnKd7F2etJU5eXA@mail.gmail.com>
 <CABwTF4VvnkRUEKBT+j9fj9EyfGSFG3Ss3QejqfLy33DzKuc3DQ@mail.gmail.com>
 <CABwTF4VVYPja=f-jR8tRuNUo0Sr8eHSYQQWSBC3g7j3K2aYSbQ@mail.gmail.com>
 <CABwTF4V+veezGtNRiun1T_0u9kitS2Wk0VovKpUnZXdTCHvJ4w@mail.gmail.com>
In-Reply-To: 
 <CABwTF4V+veezGtNRiun1T_0u9kitS2Wk0VovKpUnZXdTCHvJ4w@mail.gmail.com>
From: vignesh C <vignesh21@gmail.com>
Date: Sat, 27 Jan 2024 07:18:59 +0530
Message-ID: 
 <CALDaNm2=4afz6Tqgi6c+FL1h5Fofh34c4bHEEAUap84KSu3hJQ@mail.gmail.com>
Subject: Re: [PoC/RFC] Multiple passwords, interval expirations
To: Gurjeet Singh <gurjeet@singh.im>
Cc: Jeff Davis <pgsql@j-davis.com>, Nathan Bossart <nathandbossart@gmail.com>,
	PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>,
 Stephen Frost <sfrost@snowman.net>,
	"Brindle, Joshua" <joshuqbr@amazon.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: 
 <https://www.postgresql.org/message-id/CALDaNm2%3D4afz6Tqgi6c%2BFL1h5Fofh34c4bHEEAUap84KSu3hJQ%40mail.gmail.com>
Precedence: bulk

On Tue, 10 Oct 2023 at 16:37, Gurjeet Singh <gurjeet@singh.im> wrote:
>
> > On Mon, Oct 9, 2023 at 2:31=E2=80=AFAM Gurjeet Singh <gurjeet@singh.im>=
 wrote:
> > >
> > > Next steps:
> > > - Break the patch into a series of smaller patches.
> > > - Add TAP tests (test the ability to actually login with these passwo=
rds)
> > > - Add/update documentation
> > > - Add more regression tests
>
> Please see attached the v4 of the patchset that introduces the notion
> of named passwords slots, namely 'first' and 'second' passwords, and
> allows users to address each of these passwords separately for the
> purposes of adding, dropping, or assigning expiration times.
>
> Apart from the changes described by each patch's commit title, one
> significant change since v3 is that now (included in v4-0002...patch)
> it is not allowed for a role to have a mix of a types of passwords.
> When adding a password, the patch ensures that the password being
> added uses the same hashing algorithm (md5 or scram-sha-256) as the
> existing password, if any.  Having all passwords of the same type
> helps the server pick the corresponding authentication method during
> connection attempt.
>
> The v3 patch also had a few bugs that were exposed by cfbot's
> automatic run. All those bugs have now been fixed, and the latest run
> on the v4 branch [1] on my private Git repo shows a clean run [1].
>
> The list of patches, and their commit titles are as follows:
>
> > v4-0001-...patch Add new columns to pg_authid
> > v4-0002-...patch Update password verification infrastructure to handle =
two passwords
> > v4-0003-...patch Added SQL support for ALTER ROLE to manage two passwor=
ds
> > v4-0004-...patch Updated pg_dumpall to support exporting a role's secon=
d password
> > v4-0005-...patch Update system views pg_roles and pg_shadow
> > v4-0006-...patch Updated pg_authid catalog documentation
> > v4-0007-...patch Updated psql's describe-roles meta-command
> > v4-0008-...patch Added documentation for ALTER ROLE command
> > v4-0009-...patch Added TAP tests to prove that a role can use two passw=
ords to login
> > v4-0010-...patch pgindent run
> > v4-0011-...patch Run pgperltidy on files changed by this patchset
>
> Running pgperltidy updated many perl files unrelated to this patch, so
> in the last patch I chose to include only the one perl file that is
> affected by this patchset.

CFBot shows that the patch does not apply anymore as in [1]:
=3D=3D=3D Applying patches on top of PostgreSQL commit ID
4d969b2f85e1fd00e860366f101fd3e3160aab41 =3D=3D=3D
=3D=3D=3D applying patch
./v4-0002-Update-password-verification-infrastructure-to-ha.patch
...
patching file src/backend/libpq/auth.c
Hunk #4 FAILED at 828.
Hunk #5 succeeded at 886 (offset -2 lines).
Hunk #6 succeeded at 907 (offset -2 lines).
1 out of 6 hunks FAILED -- saving rejects to file src/backend/libpq/auth.c.=
rej

Please post an updated version for the same.

[1] - http://cfbot.cputube.org/patch_46_4432.log

Regards,
Vignesh