Change the default authentication method to SCRAM-SHA-256 #4125
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
PostgreSQL has stored passwords as SCRAM-SHA-256 since PostgreSQL 14. PGO has stored passwords as SCRAM-SHA-256 since PostgreSQL 10.
Checklist:
Type of Changes:
What is the current behavior (link to any open issues here)?
When not configured, PostgresCluster allows connections from users with an MD5 password stored in the database.
PGO has configured Postgres to hash new and rotated passwords with SCRAM for years.
What is the new behavior (if this is a feature change)?
When not configured, PostgresCluster requires users to have a SCRAM password in the database.
Passwords stored as MD5 are the exception now. In those cases, one can use
spec.authentication.rules
andspec.config.parameters
to downgrade to MD5.Other Information:
Issue: PGO-2290
See: https://www.postgresql.org/docs/current/auth-password.html