Re: Reset expired password from .NET

Fernando Grijalba <jfercan(at)yahoo(dot)com> writes:
> I just realized that Postgresql does not differentiate between an invalid username/password or an expired password when it gives you the error message.

That's intentional. Per the comments in auth.c:

* Tell the user the authentication failed, but not (much about) why.
*
* There is a tradeoff here between security concerns and making life
* unnecessarily difficult for legitimate users. We would not, for example,
* want to report the password we were expecting to receive...
* But it seems useful to report the username and authorization method
* in use, and these are items that must be presumed known to an attacker
* anyway.
* Note that many sorts of failure report additional information in the
* postmaster log, which we hope is only readable by good guys.

regards, tom lane