Skip to content

Commit b1362f8

Browse files
afiskonafiskon
committed
Apply new/0006-Add-clause-PASSWORD-val-USING-protocol-to-CREATE-ALT.patch
1 parent a8007eb commit b1362f8

File tree

4 files changed

+126
-7
lines changed

4 files changed

+126
-7
lines changed

‎doc/src/sgml/ref/alter_role.sgml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ ALTER ROLE <replaceable class="PARAMETER">role_specification</replaceable> [ WIT
3434
| BYPASSRLS | NOBYPASSRLS
3535
| CONNECTION LIMIT <replaceable class="PARAMETER">connlimit</replaceable>
3636
| [ ENCRYPTED | UNENCRYPTED ] PASSWORD '<replaceable class="PARAMETER">password</replaceable>'
37+
| PASSWORD ( '<replaceable class="PARAMETER">password</replaceable>' USING '<replaceable class="PARAMETER">method</replaceable>' )
3738
| VALID UNTIL '<replaceable class="PARAMETER">timestamp</replaceable>'
3839

3940
ALTER ROLE <replaceable class="PARAMETER">name</replaceable> RENAME TO <replaceable>new_name</replaceable>
@@ -169,6 +170,7 @@ ALTER ROLE { <replaceable class="PARAMETER">role_specification</replaceable> | A
169170
<term><literal>NOBYPASSRLS</literal></term>
170171
<term><literal>CONNECTION LIMIT</literal> <replaceable class="parameter">connlimit</replaceable></term>
171172
<term><literal>PASSWORD</> <replaceable class="parameter">password</replaceable></term>
173+
<term><literal>PASSWORD</> ( '<replaceable class="parameter">password</replaceable>' USING '<replaceable class="parameter">method</replaceable>' )</term>
172174
<term><literal>ENCRYPTED</></term>
173175
<term><literal>UNENCRYPTED</></term>
174176
<term><literal>VALID UNTIL</literal> '<replaceable class="parameter">timestamp</replaceable>'</term>
@@ -279,6 +281,14 @@ ALTER ROLE davide WITH PASSWORD 'hu8jmn3';
279281
</programlisting>
280282
</para>
281283

284+
<para>
285+
Change a role's password using MD5-encryption:
286+
287+
<programlisting>
288+
ALTER ROLE lionel WITH PASSWORD ('hu8jmn3' USING 'md5');
289+
</programlisting>
290+
</para>
291+
282292
<para>
283293
Remove a role's password:
284294

‎doc/src/sgml/ref/create_role.sgml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ CREATE ROLE <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <replac
3434
| BYPASSRLS | NOBYPASSRLS
3535
| CONNECTION LIMIT <replaceable class="PARAMETER">connlimit</replaceable>
3636
| [ ENCRYPTED | UNENCRYPTED ] PASSWORD '<replaceable class="PARAMETER">password</replaceable>'
37+
| PASSWORD ( '<replaceable class="PARAMETER">password</replaceable>' USING '<replaceable class="PARAMETER">method</replaceable>' )
3738
| VALID UNTIL '<replaceable class="PARAMETER">timestamp</replaceable>'
3839
| IN ROLE <replaceable class="PARAMETER">role_name</replaceable> [, ...]
3940
| IN GROUP <replaceable class="PARAMETER">role_name</replaceable> [, ...]
@@ -244,6 +245,23 @@ CREATE ROLE <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <replac
244245
</listitem>
245246
</varlistentry>
246247

248+
<varlistentry>
249+
<term><literal>PASSWORD</> ( '<replaceable class="parameter">password</replaceable>' USING '<replaceable class="parameter">method</replaceable>' )</term>
250+
<listitem>
251+
<para>
252+
Sets the role's password using the requested method. (A password
253+
is only of use for roles having the <literal>LOGIN</literal>
254+
attribute, but you can nonetheless define one for roles without it.)
255+
If you do not plan to use password authentication you can omit this
256+
option. The methods supported are <literal>md5</> to enforce
257+
a password to be MD5-encrypted, and <literal>plain</> to use an
258+
unencrypted password. If the password string is already in
259+
MD5-encrypted format, then it is stored encrypted even if
260+
<literal>plain</> is specified.
261+
</para>
262+
</listitem>
263+
</varlistentry>
264+
247265
<varlistentry>
248266
<term><literal>VALID UNTIL</literal> '<replaceable class="parameter">timestamp</replaceable>'</term>
249267
<listitem>
@@ -425,6 +443,14 @@ CREATE USER davide WITH PASSWORD 'jw8s0F4';
425443
that it implies <literal>LOGIN</>.)
426444
</para>
427445

446+
<para>
447+
Create a role with a MD5-encrypted password:
448+
449+
<programlisting>
450+
CREATE USER lionel WITH PASSWORD ('asdh7as' USING 'md5');
451+
</programlisting>
452+
</para>
453+
428454
<para>
429455
Create a role with a password that is valid until the end of 2004.
430456
After one second has ticked in 2005, the password is no longer

‎src/backend/commands/user.c

Lines changed: 83 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -176,18 +176,58 @@ CreateRole(ParseState *pstate, CreateRoleStmt *stmt)
176176

177177
if (strcmp(defel->defname, "password") == 0 ||
178178
strcmp(defel->defname, "encryptedPassword") == 0 ||
179-
strcmp(defel->defname, "unencryptedPassword") == 0)
179+
strcmp(defel->defname, "unencryptedPassword") == 0 ||
180+
strcmp(defel->defname, "methodPassword") == 0)
180181
{
181182
if (dpassword)
182183
ereport(ERROR,
183184
(errcode(ERRCODE_SYNTAX_ERROR),
184185
errmsg("conflicting or redundant options"),
185186
parser_errposition(pstate, defel->location)));
186187
dpassword = defel;
187-
if (strcmp(defel->defname, "encryptedPassword") == 0)
188+
if (strcmp(defel->defname, "password") == 0)
189+
{
190+
/*
191+
* Password type is enforced with GUC password_encryption
192+
* here.
193+
*/
194+
if (dpassword && dpassword->arg)
195+
password = strVal(dpassword->arg);
196+
}
197+
else if (strcmp(defel->defname, "encryptedPassword") == 0)
198+
{
188199
password_type = PASSWORD_TYPE_MD5;
200+
if (dpassword && dpassword->arg)
201+
password = strVal(dpassword->arg);
202+
}
189203
else if (strcmp(defel->defname, "unencryptedPassword") == 0)
204+
{
190205
password_type = PASSWORD_TYPE_PLAINTEXT;
206+
if (dpassword && dpassword->arg)
207+
password = strVal(dpassword->arg);
208+
}
209+
else if (strcmp(defel->defname, "methodPassword") == 0)
210+
{
211+
/*
212+
* This is a list of two elements, the password is first and
213+
* then there is the method wanted by caller.
214+
*/
215+
if (dpassword && dpassword->arg)
216+
{
217+
char *method = strVal(lsecond((List *) dpassword->arg));
218+
219+
password = strVal(linitial((List *) dpassword->arg));
220+
221+
if (strcmp(method, "md5") == 0)
222+
password_type = PASSWORD_TYPE_MD5;
223+
else if (strcmp(method, "plain") == 0)
224+
password_type = PASSWORD_TYPE_PLAINTEXT;
225+
else
226+
ereport(ERROR,
227+
(errcode(ERRCODE_SYNTAX_ERROR),
228+
errmsg("unsupported password method %s", method)));
229+
}
230+
}
191231
}
192232
else if (strcmp(defel->defname, "sysid") == 0)
193233
{
@@ -307,8 +347,6 @@ CreateRole(ParseState *pstate, CreateRoleStmt *stmt)
307347
defel->defname);
308348
}
309349

310-
if (dpassword && dpassword->arg)
311-
password = strVal(dpassword->arg);
312350
if (dissuper)
313351
issuper = intVal(dissuper->arg) != 0;
314352
if (dinherit)
@@ -582,17 +620,57 @@ AlterRole(AlterRoleStmt *stmt)
582620

583621
if (strcmp(defel->defname, "password") == 0 ||
584622
strcmp(defel->defname, "encryptedPassword") == 0 ||
623+
strcmp(defel->defname, "methodPassword") == 0 ||
585624
strcmp(defel->defname, "unencryptedPassword") == 0)
586625
{
587626
if (dpassword)
588627
ereport(ERROR,
589628
(errcode(ERRCODE_SYNTAX_ERROR),
590629
errmsg("conflicting or redundant options")));
591630
dpassword = defel;
592-
if (strcmp(defel->defname, "encryptedPassword") == 0)
631+
if (strcmp(defel->defname, "password") == 0)
632+
{
633+
/*
634+
* Password type is enforced with GUC password_encryption
635+
* here.
636+
*/
637+
if (dpassword && dpassword->arg)
638+
password = strVal(dpassword->arg);
639+
}
640+
else if (strcmp(defel->defname, "encryptedPassword") == 0)
641+
{
593642
password_type = PASSWORD_TYPE_MD5;
643+
if (dpassword && dpassword->arg)
644+
password = strVal(dpassword->arg);
645+
}
594646
else if (strcmp(defel->defname, "unencryptedPassword") == 0)
647+
{
595648
password_type = PASSWORD_TYPE_PLAINTEXT;
649+
if (dpassword && dpassword->arg)
650+
password = strVal(dpassword->arg);
651+
}
652+
else if (strcmp(defel->defname, "methodPassword") == 0)
653+
{
654+
/*
655+
* This is a list of two elements, the password is first and
656+
* then there is the method wanted by caller.
657+
*/
658+
if (dpassword && dpassword->arg)
659+
{
660+
char *method = strVal(lsecond((List *) dpassword->arg));
661+
662+
if (strcmp(method, "md5") == 0)
663+
password_type = PASSWORD_TYPE_MD5;
664+
else if (strcmp(method, "plain") == 0)
665+
password_type = PASSWORD_TYPE_PLAINTEXT;
666+
else
667+
ereport(ERROR,
668+
(errcode(ERRCODE_SYNTAX_ERROR),
669+
errmsg("unsupported password method %s", method)));
670+
671+
password = strVal(linitial((List *) dpassword->arg));
672+
}
673+
}
596674
}
597675
else if (strcmp(defel->defname, "superuser") == 0)
598676
{
@@ -680,8 +758,6 @@ AlterRole(AlterRoleStmt *stmt)
680758
defel->defname);
681759
}
682760

683-
if (dpassword && dpassword->arg)
684-
password = strVal(dpassword->arg);
685761
if (dissuper)
686762
issuper = intVal(dissuper->arg);
687763
if (dinherit)

‎src/backend/parser/gram.y

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -936,6 +936,13 @@ AlterOptRoleElem:
936936
{
937937
$$ = makeDefElem("password", NULL, @1);
938938
}
939+
| PASSWORD '(' Sconst USING Sconst ')'
940+
{
941+
$$ = makeDefElem("methodPassword",
942+
(Node *)list_make2(makeString($3),
943+
makeString($5)),
944+
@1);
945+
}
939946
| ENCRYPTED PASSWORD Sconst
940947
{
941948
$$ = makeDefElem("encryptedPassword",

0 commit comments

Comments
 (0)