NotificationsYou must be signed in to change notification settings
Fork5
Star26

Commit5e0b5dc

committed

Provide more detail in postmaster log for password authentication failures.

We tell people to examine the postmaster log if they're unsure why they aregetting auth failures, but actually only a few relatively-uncommon failurecases were given their own log detail messages in commit64e43c5.Expand on that so that every failure case detected within md5_crypt_verifygets a specific log detail message. This should cover pretty much everyordinary password auth failure cause.So far I've not noticed user demand for a similar level of auth detailfor the other auth methods, but sooner or later somebody might want towork on them. This is not that patch, though.

1 parenta967613 commit5e0b5dcCopy full SHA for 5e0b5dc

File tree

1 file changed

+15

-1

lines changed

src/backend/libpq
- crypt.c

1 file changed

+15

-1

lines changed

`‎src/backend/libpq/crypt.c`

Lines changed: 15 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -50,7 +50,11 @@ md5_crypt_verify(const Port port, const char role, char *client_pass,`
`50`	`50`	`/* Get role info from pg_authid */`
`51`	`51`	`roleTup=SearchSysCache1(AUTHNAME,PointerGetDatum(role));`
`52`	`52`	`if (!HeapTupleIsValid(roleTup))`
	`53`	`+{`
	`54`	`+*logdetail=psprintf(_("Role \"%s\" does not exist."),`
	`55`	`+role);`
`53`	`56`	`returnSTATUS_ERROR;/* no such user */`
	`57`	`+}`
`54`	`58`
`55`	`59`	`datum=SysCacheGetAttr(AUTHNAME,roleTup,`
`56`	`60`	`Anum_pg_authid_rolpassword,&isnull);`
`@@ -71,13 +75,20 @@ md5_crypt_verify(const Port port, const char role, char *client_pass,`
`71`	`75`	`ReleaseSysCache(roleTup);`
`72`	`76`
`73`	`77`	`if (*shadow_pass=='\0')`
	`78`	`+{`
	`79`	`+*logdetail=psprintf(_("User \"%s\" has an empty password."),`
	`80`	`+role);`
`74`	`81`	`returnSTATUS_ERROR;/* empty password */`
	`82`	`+}`
`75`	`83`
`76`	`84`	`CHECK_FOR_INTERRUPTS();`
`77`	`85`
`78`	`86`	`/*`
`79`	`87`	`* Compare with the encrypted or plain password depending on the`
`80`		`- * authentication method being used for this connection.`
	`88`	`+ * authentication method being used for this connection. (We do not`
	`89`	`+ * bother setting logdetail for pg_md5_encrypt failure: the only possible`
	`90`	`+ * error is out-of-memory, which is unlikely, and if it did happen adding`
	`91`	`+ * a psprintf call would only make things worse.)`
`81`	`92`	`*/`
`82`	`93`	`switch (port->hba->auth_method)`
`83`	`94`	`{`
`@@ -154,6 +165,9 @@ md5_crypt_verify(const Port port, const char role, char *client_pass,`
`154`	`165`	`else`
`155`	`166`	`retval=STATUS_OK;`
`156`	`167`	`}`
	`168`	`+else`
	`169`	`+*logdetail=psprintf(_("Password does not match for user \"%s\"."),`
	`170`	`+role);`
`157`	`171`
`158`	`172`	`if (port->hba->auth_method==uaMD5)`
`159`	`173`	`pfree(crypt_pwd);`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit5e0b5dc

File tree

1 file changed

1 file changed

`‎src/backend/libpq/crypt.c`

0 commit comments