BUG #17719: scram-sha-256 is not working on PostgreSQL 11.18
The following bug has been logged on the website:
Bug reference: 17719
Logged by: Ramiro Arias-Amaya
Email address: rariasamaya@gmail.com
PostgreSQL version: 11.18
Operating system: Debian Linux 11.5
Description:
I have two machines:
1. HP EliteDesk 800 G1 SFF business computer
21 GiB RAM, 4.5 TB hard disk
Processor: Intel i5
2. HP Envy 17-s151nr laptop
16 GiB RAM, 4 TB hard disk
Processor: Intel i7
Installing PostgreSQL 11 (11.18 was installed) under Debian 11.5. Once
postgres password has been assigned and after that edit pg_hba.conf using
scram-sha-256, I got the following result:
ramiro@HP-s151nr:~$ sudo -u postgres psql -p 5432
[sudo] password for ramiro:
Password for user postgres:
psql: error: connection to server on socket
"/var/run/postgresql/.s.PGSQL.5432" failed: FATAL: password authentication
failed for user "postgres"
ramiro@HP-s151nr:~$
Repeating the previous procedure installing from scratch PostgreSQL 14 (14.6
was installed) the command sudo -u postgres psql -p 5432 executed
flawlessly.
Repeating the procedure, installing PostgreSQL 11 (11.18 was installed),
assigning password to postgres, then edit pga_hba.conf using md5, the
command sudo -u postgres psql -p 5432 executed flawlessly.
In both machines the behaviour was the same. scram-sha-256 is not working on
PostgreSQL 11.18 , despite PostgreSQL claims it works since version 10.
scram-sha-256 DOES work on PostgreSQL version 14.6, which I tested in both
machines.
On Tue, Dec 13, 2022 at 09:02:56PM +0000, PG Bug reporting form wrote:
In both machines the behaviour was the same. scram-sha-256 is not working on
PostgreSQL 11.18 , despite PostgreSQL claims it works since version 10.
scram-sha-256 DOES work on PostgreSQL version 14.6, which I tested in both
machines.
Are you sure that you have a SCRAM password for this user in pg_authid
when it comes to 11.18? The default value of password_encryption (as
in postgresql.conf) has been changed from "md5" to "scram-sha-256" in
14 so it works out-of-the-box. When using server versions older than
14 that you need the extra step to set this parameter first, before
changing the password of a user.
--
Michael