@@ -19,23 +19,25 @@ CREATE USER credtest WITH PASSWORD 'AJ8YuRe=6O0';
19
19
SET credcheck.password_reuse_history = 1;
20
20
SET credcheck.password_reuse_interval = 365;
21
21
SELECT rolename, password_hash FROM pg_password_history WHERE rolename = 'credtest' ORDER BY password_date ;
22
- rolename | password_hash
23
- ----------+---------------
24
- (0 rows)
22
+ rolename | password_hash
23
+ ----------+------------------------------------------------------------------
24
+ credtest | 79320cea69ba581d5e17255c02ae08060f412f79a7c14d0e24ffca51fc03ec74
25
+ (1 row)
25
26
26
27
-- Add a new password in the history and set its age to 100 days
27
28
ALTER USER credtest PASSWORD 'J8YuRe=6O';
28
29
SELECT pg_password_history_timestamp('credtest', now()::timestamp - '100 days'::interval);
29
30
pg_password_history_timestamp
30
31
-------------------------------
31
- 1
32
+ 2
32
33
(1 row)
33
34
34
35
SELECT rolename, password_hash FROM pg_password_history WHERE rolename = 'credtest' ORDER BY password_date ;
35
36
rolename | password_hash
36
37
----------+------------------------------------------------------------------
37
38
credtest | e61e58c22aa6bf31a92b385932f7d0e4dbaba24fa3fdb2982510d6c72a961335
38
- (1 row)
39
+ credtest | 79320cea69ba581d5e17255c02ae08060f412f79a7c14d0e24ffca51fc03ec74
40
+ (2 rows)
39
41
40
42
-- fail, the password is in the history for less than 1 year
41
43
ALTER USER credtest PASSWORD 'J8YuRe=6O';
@@ -44,16 +46,18 @@ SELECT rolename, password_hash FROM pg_password_history WHERE rolename = 'credte
44
46
rolename | password_hash
45
47
----------+------------------------------------------------------------------
46
48
credtest | e61e58c22aa6bf31a92b385932f7d0e4dbaba24fa3fdb2982510d6c72a961335
47
- (1 row)
49
+ credtest | 79320cea69ba581d5e17255c02ae08060f412f79a7c14d0e24ffca51fc03ec74
50
+ (2 rows)
48
51
49
52
-- success, but the old password must be kept in the history (interval not reached)
50
- ALTER USER credtest PASSWORD 'AJ8YuRe=6O0 ';
53
+ ALTER USER credtest PASSWORD 'AJ8YuRe=6O1 ';
51
54
SELECT rolename, password_hash FROM pg_password_history WHERE rolename = 'credtest' ORDER BY password_date ;
52
55
rolename | password_hash
53
56
----------+------------------------------------------------------------------
54
57
credtest | e61e58c22aa6bf31a92b385932f7d0e4dbaba24fa3fdb2982510d6c72a961335
55
58
credtest | 79320cea69ba581d5e17255c02ae08060f412f79a7c14d0e24ffca51fc03ec74
56
- (2 rows)
59
+ credtest | a4a99db0eae794af3fdfeb6094da5cbd591b81cb7df6c82cdecc100a3b9ffe55
60
+ (3 rows)
57
61
58
62
-- fail, the password is still present in the history
59
63
ALTER USER credtest PASSWORD 'J8YuRe=6O';
@@ -62,7 +66,7 @@ ERROR: Cannot use this credential following the password reuse policy
62
66
SELECT pg_password_history_timestamp('credtest', now()::timestamp - '380 days'::interval);
63
67
pg_password_history_timestamp
64
68
-------------------------------
65
- 2
69
+ 3
66
70
(1 row)
67
71
68
72
-- success, the old password present in the history has expired
0 commit comments