public/postgresql_passchanger_function
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Compare commits

base: public:c856d5462f1b0aeb3820f9d6e74c6146b4954287
Branches Tags
public:master
..
compare: public:6b86f3f11193c5293ec34df771241639cd0a44eb
Branches Tags
public:master

No commits in common. "c856d5462f1b0aeb3820f9d6e74c6146b4954287" and "6b86f3f11193c5293ec34df771241639cd0a44eb" have entirely different histories.
c856d5462f ... 6b86f3f111

2 changed files with 37 additions and 70 deletions
Show Stats Expand all files Collapse all files

61
passchanger.sql
View File

@ -39,8 +39,6 @@ ALTER TABLE IF EXISTS dba.pwdhistory
-- ######################################
-- ######################################
drop function if exists dba.change_valid_until ;
CREATE OR REPLACE FUNCTION dba.change_valid_until(_usename text)
RETURNS integer
SECURITY DEFINER
@ -49,23 +47,27 @@ CREATE OR REPLACE FUNCTION dba.change_valid_until(_usename text)
VOLATILE PARALLEL UNSAFE
AS $BODY$
declare
_invokingfunction text := '';
_matches text;
_password_lifetime integer := 120 ; -- specify password lifetime in days
_retval INTEGER;
_expiration_date numeric ;
_invokingfunction text := '';
_matches text;
--_password_lifetime text := '120 days'; -- specify password lifetime
_retval INTEGER;
_expiration_date text;
begin
select extract(epoch from localtimestamp) into _expiration_date;
select _expiration_date+(_password_lifetime*24*60*60) into _expiration_date;
select now() + interval '120 days' into _expiration_date ;
select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
-- first, checking the invoking function
-- raise notice 'Invoking function: %', _invokingfunction;
--_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
-- raise notice 'Matches: %', _matches;
if _matches IS NOT NULL then
-- then checking the regex for the password
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\([[:space:]]{0,}''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''[[:space:]]{0,}\\)[[:space:]]{0,};' , 'i');
-- then checking the regex for the password
EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
return 0;
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
if _matches IS NOT NULL then
EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=to_timestamp(%L) where rolname=%L ', _expiration_date, _usename);
--EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime);
-- INTO _retval;
RETURN 0;
else
@ -73,7 +75,6 @@ begin
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Check your generated password an try again'
, hint = 'Read the official documentation' ;
RETURN 1;
end if;
else
-- also catches NULL
@ -82,7 +83,6 @@ begin
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Please call dba.change_my_password function.'
, hint = 'Invoked function: ' || _invokingfunction ;
RETURN 1;
end if;
end
$BODY$;
@ -98,18 +98,16 @@ CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
VOLATILE PARALLEL UNSAFE
AS $BODY$
declare
_min_password_length int := 12; -- specify min length here
_usename text := '';
_useraddress text := '';
_userapp text := '';
_retval integer ;
_min_password_length int := 12; -- specify min length here
_usename text := '';
_useraddress text := '';
_userapp text := '';
begin
select user into _usename;
if user = 'postgres' then
raise exception 'This function should not be run by user postgres'
using errcode = '22024' -- 22023 = "invalid_parameter_value'
, detail = 'Use a named user only.' ;
return 1;
end if;
if length(_password) < _min_password_length then
@ -119,29 +117,18 @@ begin
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Please check your password.'
, hint = 'Password must be at least ' || _min_password_length || ' characters.';
return 1;
end if;
select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ;
select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ;
--PERFORM dba.change_valid_until(_usename) ;
SELECT dba.change_valid_until(_usename)
INTO _retval;
-- this will be executed by the username invoking this function
if _retval = 0 then
EXECUTE format('ALTER USER %I WITH PASSWORD %L', _usename, _password);
insert into dba.pwdhistory
(usename, usename_addres, application_name, password, changed_on)
values (_usename, _useraddress, _userapp, md5(_password),now());
EXECUTE format('ALTER USER %I WITH PASSWORD %L', _usename, _password);
raise notice 'Password changed' ;
else
raise exception 'Could not change expiration date, please check'
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'contact the dba' ;
return 1;
end if;
PERFORM dba.change_valid_until(_usename) ;
insert into dba.pwdhistory
(usename, usename_addres, application_name, password, changed_on)
values (_usename, _useraddress, _userapp, md5(_password),now());
return 0;
end

46
passchanger_rds.sql
View File

@ -39,7 +39,7 @@ ALTER TABLE IF EXISTS dba.pwdhistory
-- ######################################
-- ######################################
drop function if exists dba.change_valid_until ;
drop function dba.change_valid_until ;
CREATE OR REPLACE FUNCTION dba.change_valid_until(_usename text, _thepassword text)
RETURNS integer
@ -51,23 +51,22 @@ AS $BODY$
declare
_invokingfunction text := '';
_matches text;
_password_lifetime integer := 120 ; -- specify password lifetime in days
_retval integer;
_expiration_epoch numeric ;
_expiration_date timestamp ;
--_password_lifetime text := '120 days'; -- specify password lifetime
_retval INTEGER;
_expiration_date text;
begin
select extract(epoch from localtimestamp) into _expiration_epoch;
select _expiration_epoch+(_password_lifetime*24*60*60) into _expiration_epoch;
select to_timestamp(_expiration_epoch) into _expiration_date ;
select now() + interval '120 days' into _expiration_date ;
select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
-- first, checking the invoking function
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
-- raise notice 'Matches: %', _matches;
if _matches IS NOT NULL then
-- then checking the regex for the password
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\([[:space:]]{0,}''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''[[:space:]]{0,}\\)[[:space:]]{0,};' , 'i');
-- catch-all regexp, avoid using it
-- _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
if _matches IS NOT NULL then
-- EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL to_timestamp(%L) ;', _usename, _thepassword, _expiration_date);
--EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval %L days ;', _usename, _thepassword, _password_lifetime);
EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL %L ;', _usename, _thepassword, _expiration_date);
-- INTO _retval;
RETURN 0;
@ -76,7 +75,6 @@ begin
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Check your generated password (' || _thepassword || ') an try again'
, hint = 'Read the official documentation' ;
RETURN 1;
end if;
else
-- also catches NULL
@ -85,7 +83,6 @@ begin
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Please call dba.change_my_password function.'
, hint = 'Invoked function: ' || _invokingfunction ;
RETURN 1;
end if;
end
$BODY$;
@ -93,9 +90,6 @@ $BODY$;
-- ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO dba;
REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text, text) From PUBLIC;
drop function if exists dba.change_my_password ;
CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
RETURNS integer
SECURITY INVOKER
@ -108,14 +102,12 @@ declare
_usename text := '';
_useraddress text := '';
_userapp text := '';
_retval integer ;
begin
select user into _usename;
if user = 'postgres' then
raise exception 'This function should not be run by user postgres'
using errcode = '22024' -- 22023 = "invalid_parameter_value'
, detail = 'Use a named user only.' ;
return 1;
end if;
if length(_password) < _min_password_length then
@ -125,27 +117,15 @@ begin
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'Please check your password.'
, hint = 'Password must be at least ' || _min_password_length || ' characters.';
return 1;
end if;
select client_addr into _useraddress from pg_stat_activity where pid = pg_backend_pid() ;
select application_name into _userapp from pg_stat_activity where pid = pg_backend_pid() ;
--PERFORM dba.change_valid_until(_usename, _password) ;
SELECT dba.change_valid_until(_usename, _password)
INTO _retval;
if _retval = 0 then
insert into dba.pwdhistory
(usename, usename_addres, application_name, password, changed_on)
values (_usename, _useraddress, _userapp, md5(_password),now());
raise notice 'Password changed' ;
else
raise exception 'Could not change expiration date, please check'
using errcode = '22023' -- 22023 = "invalid_parameter_value'
, detail = 'contact the dba' ;
return 1;
end if;
PERFORM dba.change_valid_until(_usename, _password) ;
insert into dba.pwdhistory
(usename, usename_addres, application_name, password, changed_on)
values (_usename, _useraddress, _userapp, md5(_password),now());
return 0;
end