Recently our security team have wanted to apply password complexity checks akin to Oracle's profile mechanism to PostgreSQL, checking that a password hasn't been used in x months
There would have to be a pg_catalog table which stores login history.
etc, has minimum length, x special characters and x numeric characters, mixed case etc.
Is that an after-the-fact scanner (with all the problems Tom mentioned), or is it a client-side "check while you're typing in the new password" scanner?
