From b016e1dca81947d811425d2b43b050891bd80739 Mon Sep 17 00:00:00 2001 From: Gurjeet Singh Date: Mon, 9 Oct 2023 11:36:05 -0700 Subject: [PATCH v5 1/9] Add new columns to pg_authid Add two columns to pg_authid, namely rolsecondpassword and rolsecondvaliduntil. These columns are added in preparation for the password-rollover feature. These columns will store the hash and the expiration time, repspectively, of a second password that the role can use for login authentication. --- src/backend/commands/user.c | 4 +++ src/include/catalog/pg_authid.dat | 48 ++++++++++++++++++++----------- src/include/catalog/pg_authid.h | 2 ++ 3 files changed, 38 insertions(+), 16 deletions(-) diff --git a/src/backend/commands/user.c b/src/backend/commands/user.c index c75cde2e8e..32711f413d 100644 --- a/src/backend/commands/user.c +++ b/src/backend/commands/user.c @@ -451,9 +451,13 @@ CreateRole(ParseState *pstate, CreateRoleStmt *stmt) else new_record_nulls[Anum_pg_authid_rolpassword - 1] = true; + new_record_nulls[Anum_pg_authid_rolsecondpassword - 1] = true; + new_record[Anum_pg_authid_rolvaliduntil - 1] = validUntil_datum; new_record_nulls[Anum_pg_authid_rolvaliduntil - 1] = validUntil_null; + new_record_nulls[Anum_pg_authid_rolsecondvaliduntil - 1] = true; + new_record[Anum_pg_authid_rolbypassrls - 1] = BoolGetDatum(bypassrls); /* diff --git a/src/include/catalog/pg_authid.dat b/src/include/catalog/pg_authid.dat index 55cabdda6f..8da09d1df7 100644 --- a/src/include/catalog/pg_authid.dat +++ b/src/include/catalog/pg_authid.dat @@ -23,81 +23,97 @@ rolname => 'POSTGRES', rolsuper => 't', rolinherit => 't', rolcreaterole => 't', rolcreatedb => 't', rolcanlogin => 't', rolreplication => 't', rolbypassrls => 't', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_', + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '6171', oid_symbol => 'ROLE_PG_DATABASE_OWNER', rolname => 'pg_database_owner', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_', + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '6181', oid_symbol => 'ROLE_PG_READ_ALL_DATA', rolname => 'pg_read_all_data', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_', + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '6182', oid_symbol => 'ROLE_PG_WRITE_ALL_DATA', rolname => 'pg_write_all_data', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_', + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '3373', oid_symbol => 'ROLE_PG_MONITOR', rolname => 'pg_monitor', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_', + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '3374', oid_symbol => 'ROLE_PG_READ_ALL_SETTINGS', rolname => 'pg_read_all_settings', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_', + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '3375', oid_symbol => 'ROLE_PG_READ_ALL_STATS', rolname => 'pg_read_all_stats', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_', + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '3377', oid_symbol => 'ROLE_PG_STAT_SCAN_TABLES', rolname => 'pg_stat_scan_tables', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_', + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '4569', oid_symbol => 'ROLE_PG_READ_SERVER_FILES', rolname => 'pg_read_server_files', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_', + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '4570', oid_symbol => 'ROLE_PG_WRITE_SERVER_FILES', rolname => 'pg_write_server_files', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_', + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '4571', oid_symbol => 'ROLE_PG_EXECUTE_SERVER_PROGRAM', rolname => 'pg_execute_server_program', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_', + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '4200', oid_symbol => 'ROLE_PG_SIGNAL_BACKEND', rolname => 'pg_signal_backend', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_', + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '4544', oid_symbol => 'ROLE_PG_CHECKPOINT', rolname => 'pg_checkpoint', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_' , + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '9256', oid_symbol => 'ROLE_PG_MAINTAIN', rolname => 'pg_maintain', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_' , + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '4550', oid_symbol => 'ROLE_PG_USE_RESERVED_CONNECTIONS', rolname => 'pg_use_reserved_connections', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_', + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, { oid => '6304', oid_symbol => 'ROLE_PG_CREATE_SUBSCRIPTION', rolname => 'pg_create_subscription', rolsuper => 'f', rolinherit => 't', rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f', rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1', - rolpassword => '_null_', rolvaliduntil => '_null_' }, + rolpassword => '_null_', rolvaliduntil => '_null_', + rolsecondpassword => '_null_', rolsecondvaliduntil => '_null_' }, ] diff --git a/src/include/catalog/pg_authid.h b/src/include/catalog/pg_authid.h index e08863f78a..5dca4a12b0 100644 --- a/src/include/catalog/pg_authid.h +++ b/src/include/catalog/pg_authid.h @@ -45,6 +45,8 @@ CATALOG(pg_authid,1260,AuthIdRelationId) BKI_SHARED_RELATION BKI_ROWTYPE_OID(284 #ifdef CATALOG_VARLEN /* variable-length fields start here */ text rolpassword; /* password, if any */ timestamptz rolvaliduntil; /* password expiration time, if any */ + text rolsecondpassword; /* second password, if any */ + timestamptz rolsecondvaliduntil; /* second password expiration time, if any */ #endif } FormData_pg_authid; -- 2.25.1