Vault: [database/postgres] redshift compatibility

[jippi]

the database/postgres backend works perfectly with redshift, except for one requirement, that the password must contain at least one upper character.

The following will fail with invalid password, as {{password}} is all lower-case

CREATE USER "{{name}}" PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';
GRANT SELECT ON ALL TABLES IN SCHEMA public TO "{{name}}"

The following will work, but the password outputted by vault read does (for obvious reasons) not include the A.

CREATE USER "{{name}}" PASSWORD 'A{{password}}' VALID UNTIL '{{expiration}}';
GRANT SELECT ON ALL TABLES IN SCHEMA public TO "{{name}}"

Having the {{password}} output part of the password in uppercase (just character) would make it compatible.

Not sure what the best approach to fixing this would be.

If i can get some advice on how to best approach this, i can (probably) come up with a PR fixing it

[calvn]

Hey, thanks for bringing this up! There is currently no direct way to get back A{{password}} via vault read, so the current workaround would be to perform post-processing on your end with the password retrieved from vault read and prepend the character into the result.

The fix, at least from the database plugin side, would be to modify RandomAlphaNumericOfLen() from plugins/helper/database/credsutil/credsutil.go to enforce A1a (uppercase, number, lowercase).

Another approach is to fulfill that requirement at the backend level and return the prepended password as the result, similar to the way that HANA handles its password requirement: https://github.com/hashicorp/vault/blob/master/plugins/database/hana/hana.go#L110.

[jefferai]

It might be a good idea to just unilaterally make that hana modification.

[jippi]

Personally I would prefer the password generator to output something with upper and lower and digit by default, would most likely satisfy all these random silly requirements from different backends?

[jefferai]

@jippi That's exactly what I was suggesting :-)

[jippi]

@jefferai so a PR with simply prefixing the password uuid withA1a would be acceptabel ?

[jefferai]

For all plugins, yes.