Re: md5_password_warnings for password auth with MD5-encrypted passwords

On Mon, Jun 29, 2026 at 12:00 PM Michael Paquier <michael@paquier.xyz> wrote:
> > I'm fine with expanding the warnings to "password" auth.  Something else I
> > considered is whether we should warn if a role with an MD5 password is
> > authenticated without using the password.  I ultimately decided against
> > that, but we could expand it there, too.

Agreed with that decision, i.e., I don't think we should warn in those cases
(e.g., a role with an MD5 password being authenticated via trust). The MD5
verifier isn't used for authentication there, and emitting the warning would
require an extra lookup of the role's password solely to generate the warning.
That seems like unnecessary overhead.


> FWIW, emitting a WARNING for the "password" case would make more
> people aware that they're doing something wrong.  Folks having the
> idea to allow plain password authentication should be hopefully next
> to nothing these days (mostly self-managed), but the more warned the
> less potential pain when this gets removed.

+1


> In short, I think that Fujii-san's patch is a good thing to have.

Thanks! So I'm thinking to commit the patch.

Regards,

-- 
Fujii Masao