Re: Removing a user's password - Mailing list pgsql-hackers

From Bruce Momjian
Subject Re: Removing a user's password
Date
Msg-id 200306061529.h56FTU226724@candle.pha.pa.us
Whole thread Raw
In response to Removing a user's password  (Bruce Momjian <pgman@candle.pha.pa.us>)
List pgsql-hackers
Tom Lane wrote:
> Bruce Momjian <pgman@candle.pha.pa.us> writes:
> > Well, they are not actually removing it, just setting it to NULL, as
> > though a password was never assigned.  We have a way for users to set
> > it, but no way for them to remove it.
> 
> If they had a way to remove it, then they'd no longer be able to log in
> (assuming password auth is being used, and if it isn't then who cares?)
> I'm not seeing much of anything here except a foot-gun.  It might look
> nice on the argument of symmetry, but as far as actual functionality
> goes, I think it'd be a waste of code space.  How many people have
> actually asked for this, in all the years the password support has
> been there?

I assume there are some database that require passwords and some that
don't.  I don't think we have had any requests for it.  The only recent
request was someone asking for how to alter the password after using
'createuser', and we fixed that by modifying the manual page.

I added a doc mention of also allowing ALTER USER to remove a password,
so I will just remove that mention and add this patch in the future this
if anyone sees value in removing a password.

--  Bruce Momjian                        |  http://candle.pha.pa.us pgman@candle.pha.pa.us               |  (610)
359-1001+  If your life is a hard drive,     |  13 Roberts Road +  Christ can be your backup.        |  Newtown Square,
Pennsylvania19073
 


pgsql-hackers by date:

Previous
From: Tom Lane
Date:
Subject: Re: Proposal to Re-Order Postgresql.Conf, part II
Next
From: Justin Clift
Date:
Subject: Re: Wrong version of jdbc in 7.3.3 rpms