pgsql: Log a detail message for auth failures due to missing or expired

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Log a detail message for auth failures due to missing or expired
Date: 2014-01-28 02:04:18
Message-ID: E1W7y2E-0003vX-IA@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Log a detail message for auth failures due to missing or expired password.

It's worth distinguishing these cases from run-of-the-mill wrong-password
problems, since users have been known to waste lots of time pursuing the
wrong theory about what's failing. Now, our longstanding policy about how
to report authentication failures is that we don't really want to tell the
*client* such things, since that might be giving information to a bad guy.
But there's nothing wrong with reporting the details to the postmaster log,
and indeed the comments in this area of the code contemplate that
interesting details should be so reported. We just weren't handling these
particular interesting cases usefully.

To fix, add infrastructure allowing subroutines of ClientAuthentication()
to return a string to be added to the errdetail_log field of the main
authentication-failed error report. We might later want to use this to
report other subcases of authentication failure the same way, but for the
moment I just dealt with password cases.

Per discussion of a patch from Josh Drake, though this is not what
he proposed.

Branch
------
master

Details
-------
http://git.postgresql.org/pg/commitdiff/64e43c59b817a78ddf70f2fd62de31a4add5d988

Modified Files
--------------
src/backend/libpq/auth.c | 44 +++++++++++++++++++++++++++-----------------
src/backend/libpq/crypt.c | 14 +++++++++++++-
src/include/libpq/crypt.h | 4 ++--
3 files changed, 42 insertions(+), 20 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message KONDO Mitsumasa 2014-01-28 02:04:36 Re: pgsql: Keep pg_stat_statements' query texts in a file, not in shared me
Previous Message Peter Geoghegan 2014-01-28 01:35:51 Re: pgsql: Keep pg_stat_statements' query texts in a file, not in shared me