Re: password rules

Le 24/06/2025 à 07:18, raphi a écrit :
>
>
> Am 23.06.2025 um 22:39 schrieb Christoph Berg:
>> Re: raphi
>>> Sorry for this rather long (first) email on this list but I feel
>>> like I had
>>> to explain our usecase and why LDAP is not always as simple as
>>> adding a line
>>> to hba.conf.
>> Did you give the "pam" method a try? T
> Not really because it's a local solution. How do you change passwords
> or keep history on your standby nodes? Besides, the documentation says
> that postgres can't handle /etc/shadow because it runs unprivileged,
> only pam_ldap would work. Or am I missing something?
>
> have fun,
> raphi

I think the credcheck extension has been created to handle the features
you are requesting.

> - enforce some password complexity and prevent reuse

This is already implemented.

> - expire a password immediately after creating and prompt the user to
change it upon first login try. They can connect with the initial
> password but cannot login until they've set a new password.

I have started to work some weeks ago and it just need more time to
end/polish the job.

> the password history is not being replicated to the standby so we can
not use it.

It is in my TODO list for a year as you noted and will try to implement
it this summer.

--
Gilles Darold