credcheck

pig repo add pgdg -u    # add pgdg repo and update cache

pig install credcheck;		# install via package name, for the active PG version

pig install credcheck -v 18;   # install for PG 18
pig install credcheck -v 17;   # install for PG 17
pig install credcheck -v 16;   # install for PG 16
pig install credcheck -v 15;   # install for PG 15
pig install credcheck -v 14;   # install for PG 14

shared_preload_libraries = 'credcheck';

CREATE EXTENSION credcheck;

shared_preload_libraries = 'credcheck'

-- Rejected: username too short
CREATE USER abc WITH PASSWORD 'pass';
-- ERROR: username length should match the configured credcheck.username_min_length

-- Rejected: password contains username
CREATE USER abcd$ WITH PASSWORD 'abcd$xyz';
-- ERROR: password should not contain username

SET credcheck.password_valid_until = 30;
SET credcheck.password_valid_max = 180;

CREATE USER abcd$;
-- ERROR: require a VALID UNTIL option with a date older than 30 days

SET credcheck.password_reuse_history = 2;
SET credcheck.password_reuse_interval = 365;  -- days

SELECT rolename, password_hash FROM pg_password_history;

SET credcheck.max_auth_failure = 3;  -- ban after 3 failures
SET credcheck.auth_delay_ms = 1000;  -- delay failed authentication
SET credcheck.whitelist_auth_failure = 'appuser1,appuser2';

SELECT pg_banned_role_reset();              -- reset all
SELECT pg_banned_role_reset('username');     -- reset specific user

SET credcheck.password_change_first_login = true;
CREATE USER user1 PASSWORD 'Rkd89,34' VALID UNTIL '2050-12-31';
-- first login:
-- ERROR: you must change your password first.
ALTER USER user1 PASSWORD 'Zkd89,34';

ALTER USER user1 SET credcheck_internal.force_change_password = true;

SET credcheck.disallow_password_change = on;
ALTER ROLE user1 PASSWORD 'My-New-Pass#123';
-- ERROR: you are not allowed to change your password.