From 22a2c4b576fe1423382e68b418d954208555ba34 Mon Sep 17 00:00:00 2001
From: Bruce Momjian
Date: Thu, 6 May 2004 16:59:16 +0000
Subject: Erase MD5 user passwords when a user is renamed because the username
 is used as salt for the MD5 password.

---
 doc/src/sgml/ref/alter_user.sgml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'doc/src')

diff --git a/doc/src/sgml/ref/alter_user.sgml b/doc/src/sgml/ref/alter_user.sgml
index 4af08885094..e74da13c877 100644
--- a/doc/src/sgml/ref/alter_user.sgml
+++ b/doc/src/sgml/ref/alter_user.sgml
@@ -1,5 +1,5 @@
 <!--
-$PostgreSQL: pgsql/doc/src/sgml/ref/alter_user.sgml,v 1.32 2003/11/29 19:51:38 pgsql Exp $
+$PostgreSQL: pgsql/doc/src/sgml/ref/alter_user.sgml,v 1.33 2004/05/06 16:59:16 momjian Exp $
 PostgreSQL documentation
 -->
 
@@ -57,6 +57,9 @@ ALTER USER <replaceable class="PARAMETER">name</replaceable> RESET <replaceable>
    The second variant changes the name of the user.  Only a database
    superuser can rename user accounts.  The session user cannot be
    renamed.  (Connect as a different user if you need to do that.)
+   Because <literal>MD5</>-encrypted passwords use the username as
+   cryptographic salt, renaming a user clears their <literal>MD5</>
+   password.
   </para>
 
   <para>
-- 
cgit v1.2.3