Top Inners Fields Constructors Methods
org.postgresql.util

public Class PasswordUtil

extends Object
Class Inheritance
Imports
org.postgresql.core.Utils, com.ongres.scram.common.ScramFunctions, .ScramMechanisms, com.ongres.scram.common.bouncycastle.base64.Base64, com.ongres.scram.common.stringprep.StringPreparations, java.nio.ByteBuffer, .CharBuffer, java.nio.charset.StandardCharsets, java.security.MessageDigest, .NoSuchAlgorithmException, .SecureRandom, java.sql.SQLException, java.util.Arrays, .Objects

Nested and Inner Type Summary

Modifier and TypeClass and Description
private static class
PasswordUtil.SecureRandomHolder

Field Summary

Modifier and TypeField and Description
private static final int
DEFAULT_ITERATIONS

private static final int
DEFAULT_SALT_LENGTH

Constructor Summary

AccessConstructor and Description
public
PasswordUtil()

Method Summary

Modifier and TypeMethod and Description
public static String

Returns:

The text representation of the password encrypted for md5 authentication.
encodeMd5(String
The username of the database user
user, char[]
The plain text of the user's password. The implementation will zero out the array after use
password)
Deprecated prefer org.postgresql.PGConnection#alterUserPassword(String, char[], String) or encodeScramSha256(char[]) for better security.

Encode the given password for use with md5 authentication.

public static String

Returns:

The encoded password
encodePassword(String
The username of the database user
user, char[]
The plain text of the user's password. The implementation will zero out the array after use
password, String
The encryption type for which to encode the user's password. This should match the database's supported methods and value of the password_encryption setting.
encryptionType)

Encode the given password for the specified encryption type.

public static String

Returns:

The text representation of the password encrypted for SCRAM-SHA-256 authentication
encodeScramSha256(char[]
The plain text of the user's password. The implementation will zero out the array after use
password, int
The number of iterations of the hashing algorithm to perform
iterations, byte[]
The random salt value
salt)

Generate the encoded text representation of the given password for SCRAM-SHA-256 authentication.

public static String

Returns:

The text representation of the password encrypted for SCRAM-SHA-256 authentication
encodeScramSha256(char[]
The plain text of the user's password. The implementation will zero out the array after use
password)

Encode the given password for SCRAM-SHA-256 authentication using the default iteration count and a random salt.

public static String

Returns:

An SQL statement that may be executed to change the user's password
genAlterUserPasswordSQL(String
The username of the database user
user, char[]
The plain text of the user's password. The implementation will zero out the array after use
password, String
The encryption type of the password
encryptionType)

Generate the SQL statement to alter a user's password using the given encryption.

private static SecureRandom
getSecureRandom()

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

DEFAULT_ITERATIONSback to summary
private static final int DEFAULT_ITERATIONS
DEFAULT_SALT_LENGTHback to summary
private static final int DEFAULT_SALT_LENGTH

Constructor Detail

PasswordUtilback to summary
public PasswordUtil()

Method Detail

encodeMd5back to summary
public static String encodeMd5(String user, char[] password)

Deprecated

prefer org.postgresql.PGConnection#alterUserPassword(String, char[], String) or encodeScramSha256(char[]) for better security.

Encode the given password for use with md5 authentication. The PostgreSQL server uses the username as the per-user salt so that must also be provided. The return value of this method is the literal text that may be used when creating or modifying a user with the given password without the surrounding single quotes.

Parameters
user:String

The username of the database user

password:char[]

The plain text of the user's password. The implementation will zero out the array after use

Returns:String

The text representation of the password encrypted for md5 authentication.

Annotations
@Deprecated
@SuppressWarnings:DeprecatedIsStillUsed
encodePasswordback to summary
public static String encodePassword(String user, char[] password, String encryptionType) throws SQLException

Encode the given password for the specified encryption type. The word "encryption" is used here to match the verbiage in the PostgreSQL server, i.e. the "password_encryption" setting. In reality, a cryptographic digest / HMAC operation is being performed. The database user is only required for the md5 encryption type.

Parameters
user:String

The username of the database user

password:char[]

The plain text of the user's password. The implementation will zero out the array after use

encryptionType:String

The encryption type for which to encode the user's password. This should match the database's supported methods and value of the password_encryption setting.

Returns:String

The encoded password

Exceptions
SQLException:
If an error occurs encoding the password
encodeScramSha256back to summary
public static String encodeScramSha256(char[] password, int iterations, byte[] salt)

Generate the encoded text representation of the given password for SCRAM-SHA-256 authentication. The return value of this method is the literal text that may be used when creating or modifying a user with the given password without the surrounding single quotes.

Parameters
password:char[]

The plain text of the user's password. The implementation will zero out the array after use

iterations:int

The number of iterations of the hashing algorithm to perform

salt:byte[]

The random salt value

Returns:String

The text representation of the password encrypted for SCRAM-SHA-256 authentication

encodeScramSha256back to summary
public static String encodeScramSha256(char[] password)

Encode the given password for SCRAM-SHA-256 authentication using the default iteration count and a random salt.

Parameters
password:char[]

The plain text of the user's password. The implementation will zero out the array after use

Returns:String

The text representation of the password encrypted for SCRAM-SHA-256 authentication

genAlterUserPasswordSQLback to summary
public static String genAlterUserPasswordSQL(String user, char[] password, String encryptionType) throws SQLException

Generate the SQL statement to alter a user's password using the given encryption. All other encryption settings for the password will use the driver's defaults.

Parameters
user:String

The username of the database user

password:char[]

The plain text of the user's password. The implementation will zero out the array after use

encryptionType:String

The encryption type of the password

Returns:String

An SQL statement that may be executed to change the user's password

Exceptions
SQLException:
If an error occurs encoding the password
getSecureRandomback to summary
private static SecureRandom getSecureRandom()
org.postgresql.util back to summary

private Class PasswordUtil.SecureRandomHolder

extends Object
Class Inheritance

Field Summary

Modifier and TypeField and Description
pack-priv static final SecureRandom
INSTANCE

Constructor Summary

AccessConstructor and Description
private
SecureRandomHolder()

Method Summary

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

INSTANCEback to summary
pack-priv static final SecureRandom INSTANCE

Constructor Detail

SecureRandomHolderback to summary
private SecureRandomHolder()