postgres-nio icon indicating copy to clipboard operation
postgres-nio copied to clipboard

Allow changing Postgres auth credentials while ConnectionPool is alive

Open fabianfett opened this issue 2 years ago • 2 comments

To support password rotation, the ConnectionPool should support rotating auth credentials while running. New connections should be spun up asap and old connections should be closed as once they are returned to the pool and the new connections are up.

fabianfett avatar Oct 28 '23 20:10 fabianfett

Original request from @majortom64 in #256:

For security purposes it would be great to support ephemeral database user credentials, generated by something like HashiCorp’s Vault. These credentials timeout and then need to be regenerated. When they change, the Connection Pool would need to automatically close or automatically handle getting the new credentials and updating the connection.

fabianfett avatar Oct 28 '23 20:10 fabianfett

In an ideal case, we would likely try to create a new connection with the new properties... And only accept them, if we are able to create a new connection with them. Only once we validated we can actually create new connections with the new properties, we should actually apply them to the pool (aka closing old connections). If we currently can't create connections with the old properties, who cares and we should apply them directly.

fabianfett avatar Oct 28 '23 21:10 fabianfett