Jincang database kingbasees plug-in identity_ pwdexp

Catalog

1. The plugin is introduced

2. Add plug-ins

3. Parameter configuration

4. Example

5. Uninstall plugins

---

1. The plugin is introduced

identity_pwdexp yes KingbaseES An extension of , Used to set password validity .
KingbaseES The user management of contains the attribute of password validity , The user password expiration check is to set the validity period of the user password , Restrict user login to the database after the user password expires , And enter the new password .
KingbaseES Check the expiration of user password through plug-in . This way is more flexible , When the user password expiration check is required in the practical scenario of the database , Just load the plug-in . When this function is not required , Just uninstall the plug-in .
KingbaseES Pass through 1 Global level parameters cooperate with the plug-in to implement the user password expiration check .

 

2. Add plug-ins

In the use of identity_pwdexp Before , You need to add it to kingbase.conf Of documents shared_preload_libraries in , And restart KingbaseES database .

shared_preload_libraries = 'identity_pwdexp' # (change requires restart)

3. Parameter configuration

identity_pwdexp.password_change_interval
Password validity , The unit is day ,0 Means unlimited , The value range is [0,INT_MAX], Default is 7.
Parameters can only be used in postmaster Start or by the security administrator SQL Language (alter command ) Set it up .
sentence ：Alter system set Parameter name = Parameter values ;
Run after modification select sys_reload_conf(); No need to restart the server , Effective immediately for all databases and connections .
Specify the password when creating a user , It can be done by valid until Option to specify the password validity period for this user , The specified password validity period must be later than the current time and earlier than the replacement cycle identity_pwdexp.password_change_interval Specified time .
For a user who has been successfully created and has a password , Can also pass alter Of the statement valid until Option to change the password validity , But only the security administrator has this permission , Other users cannot modify the password change cycle of themselves and others .
If it is not displayed when creating a user or modifying a user password, it can be passed valid until Option to specify the password validity period for this user , Then the system will be based on identity_pwdexp.password_change_interval The value set by the parameter will automatically calculate the password validity period .
identity_pwdexp.max_password_change_interval
Maximum password validity , The unit is day , The value range is [1,INT_MAX], Default is 30.
Parameters can only be used in postmaster Start or by the security administrator SQL Language (alter command ) Set it up .
This parameter is used to limit the setting range of password validity , When the set password validity period is greater than the maximum password validity period , The system will give an error prompt .

4. Example

-- Create extensions
\c test system
create extension identity_pwdexp;
CREATE EXTENSION

-- Set password validity to 5 God
\c test sso
show identity_pwdexp.password_change_interval;
identity_pwdexp.password_change_interval
--------------------------
7
(1 row)
alter system set identity_pwdexp.password_change_interval = 5;
ALTER SYSTEM
show identity_pwdexp.password_change_interval;
identity_pwdexp.password_change_interval
------------------------------------------
0
(1 rows )

select sys_reload_conf();
sys_reload_conf
-----------------
t
(1 rows )

show identity_pwdexp.password_change_interval;
identity_pwdexp.password_change_interval
------------------------------------------
5
(1 rows )

\c test system
call now();
now
-------------------------------
2020-04-30 15:34:30.408304+08
(1 rows )

CREATE USER u_pwd_et PASSWORD '1234567890abC/.' VALID UNTIL '2020-05-01';
CREATE ROLE

SELECT USENAME, VALUNTIL FROM SYS_USER WHERE USENAME = 'u_pwd_et';
usename | valuntil
----------+------------------------
u_pwd_et | 2020-05-01 00:00:00+08
(1 rows )

ALTER USER u_pwd_et PASSWORD '/.1234567890abC';
Warning : user "u_pwd_et" does not be locked
ALTER ROLE

SELECT USENAME, VALUNTIL FROM SYS_USER WHERE USENAME = 'u_pwd_et';
usename | valuntil
----------+-------------------------------
u_pwd_et | 2020-05-05 15:35:23.448381+08
(1 rows )

5. Uninstall plugins

modify kingbase.conf In file shared_preload_libraries Restart the database after parameters .

shared_preload_libraries = ''