Re: Bad error message on valuntil

Tom Lane-2 wrote
> "Joshua D. Drake" <

> jd@

> > writes:
>> I had a customer pulling their hair out today because they couldn't
>> login to their system. The error was consistently:
>
>> 2013-06-07 08:42:44 MST postgres 10.1.11.67 27440 FATAL: password
>> authentication failed for user "user
>
>> However the problem had nothing to do with password authentication. It
>> was because the valuntil on the user had been set till a date in the
>> past. Now technically if we just removed the word "password" from the
>> error it would be accurate but it seems it would be better to say,
>> "FATAL: the user "user" has expired".
>
> I think it's intentional that we don't tell the *client* that level of
> detail. I could see emitting a log message about it, but it's not clear
> whether that will help an unsophisticated user.
>
> regards, tom lane

I presume that "password" in this context refers to the method by which
identity is checked; some alternatives being "trust" and "ident"?

Using the same logic of why you would not expose the fact that the user is
expired versus the user has provided invalid credentials exposing "password"
is a security leak as well. And then, to top it off, provides a red herring
to the user trying to figure out why their username/password combination
isn't working.

Something like:

'Authentication for user "user" failed. Update and try again or contact the
administrator to confirm "user" is authorized to log onto the system.'

David J.

--
View this message in context: http://postgresql.1045698.n5.nabble.com/Bad-error-message-on-valuntil-tp5758369p5758383.html
Sent from the PostgreSQL - hackers mailing list archive at Nabble.com.