pg.ddx.io  pgsql-interfaces@postgresql.org mailing list archive  

help / color / mirror / Atom feed

Reset expired password from .NET
3+ messages / 2 participants
[nested] [flat]

* Reset expired password from .NET
@ 2006-05-29 16:22  Fernando Grijalba <jfercan@yahoo.com>
  0 siblings, 0 replies; 3+ messages in thread

From: Fernando Grijalba @ 2006-05-29 16:22 UTC (permalink / raw)
  To: pgsql-interfaces

Is there a way to allow the users of my application to reset their password when I get a message that the password is expired?

I am using C# and npgsql.

Thank you for your cooperation.

JFercan





^ permalink  raw  reply  [nested|flat] 3+ messages in thread

* Reset expired password from .NET
@ 2006-05-30 20:48  Fernando Grijalba <jfercan@yahoo.com>
  0 siblings, 1 reply; 3+ messages in thread

From: Fernando Grijalba @ 2006-05-30 20:48 UTC (permalink / raw)
  To: pgsql-interfaces

I just realized that Postgresql does not differentiate between an invalid username/password or an expired password when it gives you the error message.

Therefore I have to look for a different way to allow users to select their own passwords.

Thank you,

JFercan





^ permalink  raw  reply  [nested|flat] 3+ messages in thread

* Re: Reset expired password from .NET
@ 2006-05-30 23:02  Tom Lane <tgl@sss.pgh.pa.us>
  parent: Fernando Grijalba <jfercan@yahoo.com>
  0 siblings, 0 replies; 3+ messages in thread

From: Tom Lane @ 2006-05-30 23:02 UTC (permalink / raw)
  To: Fernando Grijalba <jfercan@yahoo.com>; +Cc: pgsql-interfaces

Fernando Grijalba <jfercan@yahoo.com> writes:
> I just realized that Postgresql does not differentiate between an invalid username/password or an expired password when it gives you the error message.

That's intentional.  Per the comments in auth.c:

 * Tell the user the authentication failed, but not (much about) why.
 *
 * There is a tradeoff here between security concerns and making life
 * unnecessarily difficult for legitimate users.  We would not, for example,
 * want to report the password we were expecting to receive...
 * But it seems useful to report the username and authorization method
 * in use, and these are items that must be presumed known to an attacker
 * anyway.
 * Note that many sorts of failure report additional information in the
 * postmaster log, which we hope is only readable by good guys.


			regards, tom lane



^ permalink  raw  reply  [nested|flat] 3+ messages in thread

end of thread, other threads:[~2006-05-30 23:02 UTC | newest]

Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2006-05-29 16:22 Reset expired password from .NET Fernando Grijalba <jfercan@yahoo.com>
2006-05-30 20:48 Reset expired password from .NET Fernando Grijalba <jfercan@yahoo.com>
2006-05-30 23:02 ` Tom Lane <tgl@sss.pgh.pa.us>

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox