Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 5e0b5dc

Browse files
committed
Provide more detail in postmaster log for password authentication failures.
We tell people to examine the postmaster log if they're unsure why they are getting auth failures, but actually only a few relatively-uncommon failure cases were given their own log detail messages in commit 64e43c5. Expand on that so that every failure case detected within md5_crypt_verify gets a specific log detail message. This should cover pretty much every ordinary password auth failure cause. So far I've not noticed user demand for a similar level of auth detail for the other auth methods, but sooner or later somebody might want to work on them. This is not that patch, though.
1 parent a967613 commit 5e0b5dc

File tree

1 file changed

+15
-1
lines changed

1 file changed

+15
-1
lines changed

src/backend/libpq/crypt.c

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,11 @@ md5_crypt_verify(const Port *port, const char *role, char *client_pass,
5050
/* Get role info from pg_authid */
5151
roleTup = SearchSysCache1(AUTHNAME, PointerGetDatum(role));
5252
if (!HeapTupleIsValid(roleTup))
53+
{
54+
*logdetail = psprintf(_("Role \"%s\" does not exist."),
55+
role);
5356
return STATUS_ERROR; /* no such user */
57+
}
5458

5559
datum = SysCacheGetAttr(AUTHNAME, roleTup,
5660
Anum_pg_authid_rolpassword, &isnull);
@@ -71,13 +75,20 @@ md5_crypt_verify(const Port *port, const char *role, char *client_pass,
7175
ReleaseSysCache(roleTup);
7276

7377
if (*shadow_pass == '\0')
78+
{
79+
*logdetail = psprintf(_("User \"%s\" has an empty password."),
80+
role);
7481
return STATUS_ERROR; /* empty password */
82+
}
7583

7684
CHECK_FOR_INTERRUPTS();
7785

7886
/*
7987
* Compare with the encrypted or plain password depending on the
80-
* authentication method being used for this connection.
88+
* authentication method being used for this connection. (We do not
89+
* bother setting logdetail for pg_md5_encrypt failure: the only possible
90+
* error is out-of-memory, which is unlikely, and if it did happen adding
91+
* a psprintf call would only make things worse.)
8192
*/
8293
switch (port->hba->auth_method)
8394
{
@@ -154,6 +165,9 @@ md5_crypt_verify(const Port *port, const char *role, char *client_pass,
154165
else
155166
retval = STATUS_OK;
156167
}
168+
else
169+
*logdetail = psprintf(_("Password does not match for user \"%s\"."),
170+
role);
157171

158172
if (port->hba->auth_method == uaMD5)
159173
pfree(crypt_pwd);

0 commit comments

Comments
 (0)