Thread: BUG #17719: scram-sha-256 is not working on PostgreSQL 11.18

The following bug has been logged on the website:

Bug reference:      17719
Logged by:          Ramiro Arias-Amaya
Email address:      rariasamaya@gmail.com
PostgreSQL version: 11.18
Operating system:   Debian Linux 11.5
Description:

I have two machines:
1. HP EliteDesk 800 G1 SFF business computer
    21 GiB RAM,  4.5 TB hard disk
    Processor: Intel i5

2. HP Envy 17-s151nr laptop
    16 GiB RAM,  4 TB hard disk
    Processor: Intel i7

Installing PostgreSQL 11 (11.18 was installed) under Debian 11.5. Once
postgres password has been assigned and after that edit pg_hba.conf using
scram-sha-256,  I got the following result:

ramiro@HP-s151nr:~$ sudo -u postgres psql -p 5432
[sudo] password for ramiro: 
Password for user postgres: 
psql: error: connection to server on socket
"/var/run/postgresql/.s.PGSQL.5432" failed: FATAL:  password authentication
failed for user "postgres"
ramiro@HP-s151nr:~$

Repeating the previous procedure installing from scratch PostgreSQL 14 (14.6
was installed) the command  sudo -u postgres psql -p 5432  executed
flawlessly.

Repeating the procedure, installing PostgreSQL 11 (11.18 was installed),
assigning password to postgres, then edit pga_hba.conf using md5, the
command sudo -u postgres psql -p 5432  executed flawlessly.

In both machines the behaviour was the same. scram-sha-256 is not working on
PostgreSQL 11.18 , despite PostgreSQL claims it works since version 10.
scram-sha-256 DOES work on PostgreSQL version 14.6, which I tested in both
machines.

On Tue, Dec 13, 2022 at 09:02:56PM +0000, PG Bug reporting form wrote:
> In both machines the behaviour was the same. scram-sha-256 is not working on
> PostgreSQL 11.18 , despite PostgreSQL claims it works since version 10.
> scram-sha-256 DOES work on PostgreSQL version 14.6, which I tested in both
> machines.

Are you sure that you have a SCRAM password for this user in pg_authid
when it comes to 11.18?  The default value of password_encryption (as
in postgresql.conf) has been changed from "md5" to "scram-sha-256" in
14 so it works out-of-the-box.  When using server versions older than
14 that you need the extra step to set this parameter first, before
changing the password of a user.
--
Michael