diff options
Diffstat (limited to 'src/test/regress/expected/password.out')
| -rw-r--r-- | src/test/regress/expected/password.out | 59 |
1 files changed, 28 insertions, 31 deletions
diff --git a/src/test/regress/expected/password.out b/src/test/regress/expected/password.out index 5b0b955b29..bb25ad0c2c 100644 --- a/src/test/regress/expected/password.out +++ b/src/test/regress/expected/password.out @@ -4,22 +4,18 @@ -- Tests for GUC password_encryption SET password_encryption = 'novalue'; -- error ERROR: invalid value for parameter "password_encryption": "novalue" -HINT: Available values: plain, md5, scram-sha-256, off, on. +HINT: Available values: md5, scram-sha-256. SET password_encryption = true; -- ok SET password_encryption = 'md5'; -- ok -SET password_encryption = 'plain'; -- ok SET password_encryption = 'scram-sha-256'; -- ok -- consistency of password entries -SET password_encryption = 'plain'; -CREATE ROLE regress_passwd1 PASSWORD 'role_pwd1'; SET password_encryption = 'md5'; -CREATE ROLE regress_passwd2 PASSWORD 'role_pwd2'; +CREATE ROLE regress_passwd1 PASSWORD 'role_pwd1'; SET password_encryption = 'on'; -CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3'; +CREATE ROLE regress_passwd2 PASSWORD 'role_pwd2'; SET password_encryption = 'scram-sha-256'; -CREATE ROLE regress_passwd4 PASSWORD 'role_pwd4'; -SET password_encryption = 'plain'; -CREATE ROLE regress_passwd5 PASSWORD NULL; +CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3'; +CREATE ROLE regress_passwd4 PASSWORD NULL; -- check list of created entries -- -- The scram verifier will look something like: @@ -33,56 +29,57 @@ SELECT rolname, regexp_replace(rolpassword, '(SCRAM-SHA-256)\$(\d+):([a-zA-Z0-9+ ORDER BY rolname, rolpassword; rolname | rolpassword_masked -----------------+--------------------------------------------------- - regress_passwd1 | role_pwd1 + regress_passwd1 | md5783277baca28003b33453252be4dbb34 regress_passwd2 | md54044304ba511dd062133eb5b4b84a2a3 - regress_passwd3 | md50e5699b6911d87f17a08b8d76a21e8b8 - regress_passwd4 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey> - regress_passwd5 | -(5 rows) + regress_passwd3 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey> + regress_passwd4 | +(4 rows) -- Rename a role -ALTER ROLE regress_passwd3 RENAME TO regress_passwd3_new; +ALTER ROLE regress_passwd2 RENAME TO regress_passwd2_new; NOTICE: MD5 password cleared because of role rename -- md5 entry should have been removed SELECT rolname, rolpassword FROM pg_authid - WHERE rolname LIKE 'regress_passwd3_new' + WHERE rolname LIKE 'regress_passwd2_new' ORDER BY rolname, rolpassword; rolname | rolpassword ---------------------+------------- - regress_passwd3_new | + regress_passwd2_new | (1 row) -ALTER ROLE regress_passwd3_new RENAME TO regress_passwd3; --- ENCRYPTED and UNENCRYPTED passwords -ALTER ROLE regress_passwd1 UNENCRYPTED PASSWORD 'foo'; -- unencrypted -ALTER ROLE regress_passwd2 UNENCRYPTED PASSWORD 'md5dfa155cadd5f4ad57860162f3fab9cdb'; -- encrypted with MD5 +ALTER ROLE regress_passwd2_new RENAME TO regress_passwd2; +-- Change passwords with ALTER USER. With plaintext or already-encrypted +-- passwords. SET password_encryption = 'md5'; -ALTER ROLE regress_passwd3 ENCRYPTED PASSWORD 'foo'; -- encrypted with MD5 -ALTER ROLE regress_passwd4 ENCRYPTED PASSWORD 'SCRAM-SHA-256$4096:VLK4RMaQLCvNtQ==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo='; -- client-supplied SCRAM verifier, use as it is +-- encrypt with MD5 +ALTER ROLE regress_passwd2 PASSWORD 'foo'; +-- already encrypted, use as they are +ALTER ROLE regress_passwd1 PASSWORD 'md5cd3578025fe2c3d7ed1b9a9b26238b70'; +ALTER ROLE regress_passwd3 PASSWORD 'SCRAM-SHA-256$4096:VLK4RMaQLCvNtQ==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo='; SET password_encryption = 'scram-sha-256'; -ALTER ROLE regress_passwd5 ENCRYPTED PASSWORD 'foo'; -- create SCRAM verifier -CREATE ROLE regress_passwd6 ENCRYPTED PASSWORD 'md53725413363ab045e20521bf36b8d8d7f'; -- encrypted with MD5, use as it is +-- create SCRAM verifier +ALTER ROLE regress_passwd4 PASSWORD 'foo'; +-- already encrypted with MD5, use as it is +CREATE ROLE regress_passwd5 PASSWORD 'md5e73a4b11df52a6068f8b39f90be36023'; SELECT rolname, regexp_replace(rolpassword, '(SCRAM-SHA-256)\$(\d+):([a-zA-Z0-9+/=]+)\$([a-zA-Z0-9+=/]+):([a-zA-Z0-9+/=]+)', '\1$\2:<salt>$<storedkey>:<serverkey>') as rolpassword_masked FROM pg_authid WHERE rolname LIKE 'regress_passwd%' ORDER BY rolname, rolpassword; rolname | rolpassword_masked -----------------+--------------------------------------------------- - regress_passwd1 | foo + regress_passwd1 | md5cd3578025fe2c3d7ed1b9a9b26238b70 regress_passwd2 | md5dfa155cadd5f4ad57860162f3fab9cdb - regress_passwd3 | md5530de4c298af94b3b9f7d20305d2a1bf + regress_passwd3 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey> regress_passwd4 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey> - regress_passwd5 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey> - regress_passwd6 | md53725413363ab045e20521bf36b8d8d7f -(6 rows) + regress_passwd5 | md5e73a4b11df52a6068f8b39f90be36023 +(5 rows) DROP ROLE regress_passwd1; DROP ROLE regress_passwd2; DROP ROLE regress_passwd3; DROP ROLE regress_passwd4; DROP ROLE regress_passwd5; -DROP ROLE regress_passwd6; -- all entries should have been removed SELECT rolname, rolpassword FROM pg_authid |