The credcheck extension for PostgreSQL, which enforces credential policies such as password complexity, expiration, reuse, and authentication failure limits, has reached version 5.0. This major release adds support for PostgreSQL 19 and enhances the extension's behavior in replicated environments.
Key changes in credcheck 5.0:
- PostgreSQL 19 compatibility: The extension now compiles and works with the latest PostgreSQL major version.
- Replication-aware password history: Password history checks now correctly replicate across standby servers, ensuring consistent policy enforcement in high-availability setups.
- Modified behavior of
credcheck.disallow_change_password: This GUC (Grand Unified Configuration) now prevents users from changing their own passwords, with an improved implementation. credcheck.superuser_nocheck: A new GUC that, when enabled, disables allCREATE/ALTER ROLEchecks for superusers. This allows superusers to bypass credential rules for administrative accounts. The default is off.- Bug fixes for issues reported since the last release, improving overall stability.
- Upgrade requirement: A PostgreSQL restart is required to reload the shared library after upgrading.
For developers managing PostgreSQL authentication policies, credcheck 5.0 simplifies enforcement in complex environments. The new superuser_nocheck option is particularly useful for allowing superusers to manage accounts without being constrained by the same rules as regular users. The replication-aware password history ensures that password reuse policies remain consistent across all nodes in a streaming replication setup.
Source: https://www.postgresql.org/about/news/credcheck-v50-has-been-released-3329/