Compare commits

...

3 Commits

Author SHA1 Message Date
4e5568bf19
added fields to the audit table 2022-01-21 17:47:10 +01:00
bea07c5ab7
changed pwdhistory table
added additional fields for more infomation
2022-01-21 17:38:48 +01:00
c1db5741db
User postgre should not use this function 2022-01-21 17:25:56 +01:00

View File

@ -15,11 +15,17 @@ grant pg_read_all_stats to dba ;
CREATE TABLE IF NOT EXISTS dba.pwdhistory CREATE TABLE IF NOT EXISTS dba.pwdhistory
( (
usename character varying COLLATE pg_catalog."default", usename character varying COLLATE pg_catalog."default",
usename_addres character varying COLLATE pg_catalog."default",
application_name character varying COLLATE pg_catalog."default",
password character varying COLLATE pg_catalog."default", password character varying COLLATE pg_catalog."default",
changed_on timestamp without time zone changed_on timestamp without time zone
) )
TABLESPACE pg_default; TABLESPACE pg_default;
-- alter if you come from a previous version of the table:
-- alter table dba.pwdhistory add column usename_addres character varying ;
-- alter table dba.pwdhistory add column application_name character varying ;
ALTER TABLE IF EXISTS dba.pwdhistory ALTER TABLE IF EXISTS dba.pwdhistory
OWNER to dba; OWNER to dba;
@ -76,8 +82,12 @@ AS $BODY$
declare declare
_min_password_length int := 8; -- specify min length here _min_password_length int := 8; -- specify min length here
_usename text := ''; _usename text := '';
_useraddress text := '';
_userapp text := '';
begin begin
select user into _usename; select user into _usename;
select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ;
select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ;
if length(_password) >= _min_password_length then if length(_password) >= _min_password_length then
EXECUTE format('ALTER USER %I WITH PASSWORD %L', _usename, _password); EXECUTE format('ALTER USER %I WITH PASSWORD %L', _usename, _password);
else -- also catches NULL else -- also catches NULL
@ -87,20 +97,18 @@ begin
, detail = 'Please check your password.' , detail = 'Please check your password.'
, hint = 'Password must be at least ' || _min_password_length || ' characters.'; , hint = 'Password must be at least ' || _min_password_length || ' characters.';
end if; end if;
if user = 'postgres' then
raise exception 'This function should not be run by user postgres'
using errcode = '22024' -- 22023 = "invalid_parameter_value'
, detail = 'Use a named user only.' ;
else
insert into dba.pwdhistory insert into dba.pwdhistory
(usename, password, changed_on) (usename, usename_addres, application_name, password, changed_on)
values (_usename, md5(_password),now()); values (_usename, _useraddress, _userapp, md5(_password),now());
PERFORM dba.change_valid_until(_usename) ; PERFORM dba.change_valid_until(_usename) ;
-- EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename); end if;
-- update pg_catalog.pg_authid
-- set rolvaliduntil='2021-12-30 00:00:00+01' where rolname='dodger' ;
return 0; return 0;
exception
-- trap existing error and re-raise with added detail
when unique_violation then -- = error code 23505
raise unique_violation
using detail = 'Password already used earlier. Please try again with a different password.';
end end
$BODY$; $BODY$;