You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -54,24 +54,30 @@ ALTER ROLE regress_passwd2_new RENAME TO regress_passwd2;
1017
+
@@ -54,24 +54,16 @@ ALTER ROLE regress_passwd2_new RENAME TO regress_passwd2;
1018
1018
-- passwords.
1019
1019
SET password_encryption = 'md5';
1020
1020
-- encrypt with MD5
1021
1021
-ALTER ROLE regress_passwd2 PASSWORD 'foo';
1022
+
--- already encrypted, use as they are
1023
+
-ALTER ROLE regress_passwd1 PASSWORD 'md5cd3578025fe2c3d7ed1b9a9b26238b70';
1024
+
-ALTER ROLE regress_passwd3 PASSWORD 'SCRAM-SHA-256$4096:VLK4RMaQLCvNtQ==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo=';
1022
1025
+ALTER ROLE regress_passwd2 PASSWORD NEON_PASSWORD_PLACEHOLDER;
1023
-
-- already encrypted, use as they are
1024
-
ALTER ROLE regress_passwd1 PASSWORD 'md5cd3578025fe2c3d7ed1b9a9b26238b70';
1025
-
+ERROR: Received HTTP code 400 from control plane: {"error":"Neon only supports being given plaintext passwords"}
1026
-
ALTER ROLE regress_passwd3 PASSWORD 'SCRAM-SHA-256$4096:VLK4RMaQLCvNtQ==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo=';
1027
-
+ERROR: Received HTTP code 400 from control plane: {"error":"Neon only supports being given plaintext passwords"}
1028
1026
SET password_encryption = 'scram-sha-256';
1029
1027
-- create SCRAM secret
1030
1028
-ALTER ROLE regress_passwd4 PASSWORD 'foo';
1029
+
--- already encrypted with MD5, use as it is
1030
+
-CREATE ROLE regress_passwd5 PASSWORD 'md5e73a4b11df52a6068f8b39f90be36023';
1031
+
--- This looks like a valid SCRAM-SHA-256 secret, but it is not
1032
+
--- so it should be hashed with SCRAM-SHA-256.
1033
+
-CREATE ROLE regress_passwd6 PASSWORD 'SCRAM-SHA-256$1234';
1034
+
--- These may look like valid MD5 secrets, but they are not, so they
1035
+
--- should be hashed with SCRAM-SHA-256.
1036
+
--- trailing garbage at the end
1037
+
-CREATE ROLE regress_passwd7 PASSWORD 'md5012345678901234567890123456789zz';
1038
+
--- invalid length
1039
+
-CREATE ROLE regress_passwd8 PASSWORD 'md501234567890123456789012345678901zz';
1031
1040
+ALTER ROLE regress_passwd4 PASSWORD NEON_PASSWORD_PLACEHOLDER;
1032
-
-- already encrypted with MD5, use as it is
1033
-
CREATE ROLE regress_passwd5 PASSWORD 'md5e73a4b11df52a6068f8b39f90be36023';
1034
-
+ERROR: Received HTTP code 400 from control plane: {"error":"Neon only supports being given plaintext passwords"}
1035
-
-- This looks like a valid SCRAM-SHA-256 secret, but it is not
1036
-
-- so it should be hashed with SCRAM-SHA-256.
1037
-
CREATE ROLE regress_passwd6 PASSWORD 'SCRAM-SHA-256$1234';
1038
-
+ERROR: Received HTTP code 400 from control plane: {"error":"Neon only supports being given plaintext passwords"}
1039
-
-- These may look like valid MD5 secrets, but they are not, so they
1040
-
-- should be hashed with SCRAM-SHA-256.
1041
-
-- trailing garbage at the end
1042
-
CREATE ROLE regress_passwd7 PASSWORD 'md5012345678901234567890123456789zz';
1043
-
+ERROR: Received HTTP code 400 from control plane: {"error":"Neon only supports being given plaintext passwords"}
1044
-
-- invalid length
1045
-
CREATE ROLE regress_passwd8 PASSWORD 'md501234567890123456789012345678901zz';
1046
-
+ERROR: Received HTTP code 400 from control plane: {"error":"Neon only supports being given plaintext passwords"}
1041
+
+-- Neon does not support encrypted passwords, use unencrypted instead
1042
+
+CREATE ROLE regress_passwd5 PASSWORD NEON_PASSWORD_PLACEHOLDER;
1043
+
+-- Neon does not support encrypted passwords, use unencrypted instead
1044
+
+CREATE ROLE regress_passwd6 PASSWORD NEON_PASSWORD_PLACEHOLDER;
1045
+
+CREATE ROLE regress_passwd7 PASSWORD NEON_PASSWORD_PLACEHOLDER;
1046
+
+CREATE ROLE regress_passwd8 PASSWORD NEON_PASSWORD_PLACEHOLDER;
1047
1047
-- Changing the SCRAM iteration count
1048
1048
SET scram_iterations = 1024;
1049
1049
CREATE ROLE regress_passwd9 PASSWORD 'alterediterationcount';
NOTICE: empty string is not a valid password, clearing password
@@ -1082,56 +1080,37 @@ index 8475231735..1afae5395f 100644
1082
1080
-(1 row)
1083
1081
+(0 rows)
1084
1082
1085
-
-- Test with invalid stored and server keys.
1086
-
--
1087
-
-- The first is valid, to act as a control. The others have too long
1088
-
-- stored/server keys. They will be re-hashed.
1089
-
CREATE ROLE regress_passwd_sha_len0 PASSWORD 'SCRAM-SHA-256$4096:A6xHKoH/494E941doaPOYg==$Ky+A30sewHIH3VHQLRN9vYsuzlgNyGNKCh37dy96Rqw=:COPdlNiIkrsacU5QoxydEuOH6e/KfiipeETb/bPw8ZI=';
1090
-
+ERROR: Received HTTP code 400 from control plane: {"error":"Neon only supports being given plaintext passwords"}
1091
-
CREATE ROLE regress_passwd_sha_len1 PASSWORD 'SCRAM-SHA-256$4096:A6xHKoH/494E941doaPOYg==$Ky+A30sewHIH3VHQLRN9vYsuzlgNyGNKCh37dy96RqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=:COPdlNiIkrsacU5QoxydEuOH6e/KfiipeETb/bPw8ZI=';
1092
-
+ERROR: Received HTTP code 400 from control plane: {"error":"Neon only supports being given plaintext passwords"}
1093
-
CREATE ROLE regress_passwd_sha_len2 PASSWORD 'SCRAM-SHA-256$4096:A6xHKoH/494E941doaPOYg==$Ky+A30sewHIH3VHQLRN9vYsuzlgNyGNKCh37dy96Rqw=:COPdlNiIkrsacU5QoxydEuOH6e/KfiipeETb/bPw8ZIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';
1094
-
+ERROR: Received HTTP code 400 from control plane: {"error":"Neon only supports being given plaintext passwords"}
1083
+
--- Test with invalid stored and server keys.
1084
+
---
1085
+
--- The first is valid, to act as a control. The others have too long
1086
+
--- stored/server keys. They will be re-hashed.
1087
+
-CREATE ROLE regress_passwd_sha_len0 PASSWORD 'SCRAM-SHA-256$4096:A6xHKoH/494E941doaPOYg==$Ky+A30sewHIH3VHQLRN9vYsuzlgNyGNKCh37dy96Rqw=:COPdlNiIkrsacU5QoxydEuOH6e/KfiipeETb/bPw8ZI=';
1088
+
-CREATE ROLE regress_passwd_sha_len1 PASSWORD 'SCRAM-SHA-256$4096:A6xHKoH/494E941doaPOYg==$Ky+A30sewHIH3VHQLRN9vYsuzlgNyGNKCh37dy96RqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=:COPdlNiIkrsacU5QoxydEuOH6e/KfiipeETb/bPw8ZI=';
1089
+
-CREATE ROLE regress_passwd_sha_len2 PASSWORD 'SCRAM-SHA-256$4096:A6xHKoH/494E941doaPOYg==$Ky+A30sewHIH3VHQLRN9vYsuzlgNyGNKCh37dy96Rqw=:COPdlNiIkrsacU5QoxydEuOH6e/KfiipeETb/bPw8ZIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';
1090
+
+-- Neon does not support encrypted passwords, use unencrypted instead
1091
+
+CREATE ROLE regress_passwd_sha_len0 PASSWORD NEON_PASSWORD_PLACEHOLDER;
1092
+
+CREATE ROLE regress_passwd_sha_len1 PASSWORD NEON_PASSWORD_PLACEHOLDER;
1093
+
+CREATE ROLE regress_passwd_sha_len2 PASSWORD NEON_PASSWORD_PLACEHOLDER;
1095
1094
-- Check that the invalid secrets were re-hashed. A re-hashed secret
1096
1095
-- should not contain the original salt.
1097
1096
SELECT rolname, rolpassword not like '%A6xHKoH/494E941doaPOYg==%' as is_rolpassword_rehashed
1098
-
FROM pg_authid
1099
-
WHERE rolname LIKE 'regress_passwd_sha_len%'
1097
+
@@ -120,7 +109,7 @@ SELECT rolname, rolpassword not like '%A6xHKoH/494E941doaPOYg==%' as is_rolpassw
@@ -10,11 +10,11 @@ SET password_encryption = 'scram-sha-256'; -- ok
@@ -3213,23 +3192,59 @@ index 53e86b0b6c..f07cf1ec54 100644
3213
3192
3214
3193
-- check list of created entries
3215
3194
--
3216
-
@@ -42,14 +42,14 @@ ALTER ROLE regress_passwd2_new RENAME TO regress_passwd2;
3195
+
@@ -42,26 +42,18 @@ ALTER ROLE regress_passwd2_new RENAME TO regress_passwd2;
3217
3196
SET password_encryption = 'md5';
3218
3197
3219
3198
-- encrypt with MD5
3220
3199
-ALTER ROLE regress_passwd2 PASSWORD 'foo';
3200
+
--- already encrypted, use as they are
3201
+
-ALTER ROLE regress_passwd1 PASSWORD 'md5cd3578025fe2c3d7ed1b9a9b26238b70';
3202
+
-ALTER ROLE regress_passwd3 PASSWORD 'SCRAM-SHA-256$4096:VLK4RMaQLCvNtQ==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo=';
3221
3203
+ALTER ROLE regress_passwd2 PASSWORD NEON_PASSWORD_PLACEHOLDER;
3222
-
-- already encrypted, use as they are
3223
-
ALTER ROLE regress_passwd1 PASSWORD 'md5cd3578025fe2c3d7ed1b9a9b26238b70';
3224
-
ALTER ROLE regress_passwd3 PASSWORD 'SCRAM-SHA-256$4096:VLK4RMaQLCvNtQ==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo=';
3225
3204
3226
3205
SET password_encryption = 'scram-sha-256';
3227
3206
-- create SCRAM secret
3228
3207
-ALTER ROLE regress_passwd4 PASSWORD 'foo';
3208
+
--- already encrypted with MD5, use as it is
3209
+
-CREATE ROLE regress_passwd5 PASSWORD 'md5e73a4b11df52a6068f8b39f90be36023';
3229
3210
+ALTER ROLE regress_passwd4 PASSWORD NEON_PASSWORD_PLACEHOLDER;
3230
-
-- already encrypted with MD5, use as it is
3231
-
CREATE ROLE regress_passwd5 PASSWORD 'md5e73a4b11df52a6068f8b39f90be36023';
3211
+
+-- Neon does not support encrypted passwords, use unencrypted instead
3212
+
+CREATE ROLE regress_passwd5 PASSWORD NEON_PASSWORD_PLACEHOLDER;
3213
+
3214
+
--- This looks like a valid SCRAM-SHA-256 secret, but it is not
3215
+
--- so it should be hashed with SCRAM-SHA-256.
3216
+
-CREATE ROLE regress_passwd6 PASSWORD 'SCRAM-SHA-256$1234';
3217
+
--- These may look like valid MD5 secrets, but they are not, so they
3218
+
--- should be hashed with SCRAM-SHA-256.
3219
+
--- trailing garbage at the end
3220
+
-CREATE ROLE regress_passwd7 PASSWORD 'md5012345678901234567890123456789zz';
3221
+
--- invalid length
3222
+
-CREATE ROLE regress_passwd8 PASSWORD 'md501234567890123456789012345678901zz';
3223
+
+-- Neon does not support encrypted passwords, use unencrypted instead
3224
+
+CREATE ROLE regress_passwd6 PASSWORD NEON_PASSWORD_PLACEHOLDER;
3225
+
+CREATE ROLE regress_passwd7 PASSWORD NEON_PASSWORD_PLACEHOLDER;
3226
+
+CREATE ROLE regress_passwd8 PASSWORD NEON_PASSWORD_PLACEHOLDER;
3227
+
3228
+
-- Changing the SCRAM iteration count
3229
+
SET scram_iterations = 1024;
3230
+
@@ -78,13 +70,10 @@ ALTER ROLE regress_passwd_empty PASSWORD 'md585939a5ce845f1a1b620742e3c659e0a';
3231
+
ALTER ROLE regress_passwd_empty PASSWORD 'SCRAM-SHA-256$4096:hpFyHTUsSWcR7O9P$LgZFIt6Oqdo27ZFKbZ2nV+vtnYM995pDh9ca6WSi120=:qVV5NeluNfUPkwm7Vqat25RjSPLkGeoZBQs6wVv+um4=';
3232
+
SELECT rolpassword FROM pg_authid WHERE rolname='regress_passwd_empty';
3232
3233
3234
+
--- Test with invalid stored and server keys.
3235
+
---
3236
+
--- The first is valid, to act as a control. The others have too long
3237
+
--- stored/server keys. They will be re-hashed.
3238
+
-CREATE ROLE regress_passwd_sha_len0 PASSWORD 'SCRAM-SHA-256$4096:A6xHKoH/494E941doaPOYg==$Ky+A30sewHIH3VHQLRN9vYsuzlgNyGNKCh37dy96Rqw=:COPdlNiIkrsacU5QoxydEuOH6e/KfiipeETb/bPw8ZI=';
3239
+
-CREATE ROLE regress_passwd_sha_len1 PASSWORD 'SCRAM-SHA-256$4096:A6xHKoH/494E941doaPOYg==$Ky+A30sewHIH3VHQLRN9vYsuzlgNyGNKCh37dy96RqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=:COPdlNiIkrsacU5QoxydEuOH6e/KfiipeETb/bPw8ZI=';
3240
+
-CREATE ROLE regress_passwd_sha_len2 PASSWORD 'SCRAM-SHA-256$4096:A6xHKoH/494E941doaPOYg==$Ky+A30sewHIH3VHQLRN9vYsuzlgNyGNKCh37dy96Rqw=:COPdlNiIkrsacU5QoxydEuOH6e/KfiipeETb/bPw8ZIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';
3241
+
+-- Neon does not support encrypted passwords, use unencrypted instead
3242
+
+CREATE ROLE regress_passwd_sha_len0 PASSWORD NEON_PASSWORD_PLACEHOLDER;
3243
+
+CREATE ROLE regress_passwd_sha_len1 PASSWORD NEON_PASSWORD_PLACEHOLDER;
3244
+
+CREATE ROLE regress_passwd_sha_len2 PASSWORD NEON_PASSWORD_PLACEHOLDER;
3245
+
3246
+
-- Check that the invalid secrets were re-hashed. A re-hashed secret
0 commit comments