애플리케이션의 데이터베이스 사용자가 기본 제공 비밀번호 기반 메서드를 사용하여 AlloyDB Omni로 인증하는 경우 안전한 비밀번호를 적용하여 인증을 더 안전하게 만들 수 있습니다. AlloyDB Omni 비밀번호 정책을 설정하여 비밀번호 시행을 정의하고 사용 설정할 수 있습니다.
비밀번호 정책의 제한사항
AlloyDB Omni 비밀번호 정책에는 다음과 같은 제한사항이 있습니다.
비밀번호 정책은 정책을 설정한 후에 생성된 비밀번호에만 적용됩니다.
기존 사용자 비밀번호는 비밀번호 정책 변경의 영향을 받지 않습니다.
비밀번호 정책은 일반 텍스트로만 입력된 비밀번호에 적용됩니다. 암호화된 문자열로 입력된 비밀번호에는 비밀번호 정책이 적용되지 않습니다.
AlloyDB Omni 비밀번호 정책 설정
postgresql.conf 구성 파일에서 GUC (Grand Unified Configuration) 비밀번호 매개변수를 업데이트하여 비밀번호 정책을 설정합니다. GUC 매개변수를 설정하는 방법을 알아보려면 AlloyDB Omni 데이터베이스 플래그 구성을 참고하세요.
AlloyDB Omni의 비밀번호 정책에는 다음 옵션이 포함될 수 있습니다.
사용자 이름 사용 금지: 비밀번호에서 사용자 이름을 사용하지 못하게 합니다.
비밀번호 복잡성: 비밀번호에 허용된 수의 소문자, 대문자, 숫자, 영숫자가 아닌 문자가 포함되어 있는지 확인합니다. 비밀번호 길이가 유효한지도 확인합니다.
비밀번호 만료: 비밀번호가 정기적으로 순환되는지 확인합니다.
AlloyDB Omni에서 지원하는 비밀번호 정책 플래그 목록은 비밀번호 정책 플래그를 참고하세요.
비밀번호 유효성 검사 라이브러리 미리 로드
AlloyDB Omni에서 비밀번호 정책이 적용되려면 alloydb_password_validation 라이브러리를 로드해야 합니다. 이 라이브러리를 로드하려면 다음을 실행하세요.
AlloyDB Omni 설치의 postgresql.conf 구성 파일을 찾아 텍스트 편집기에서 엽니다.
shared_preload_libraries 줄을 찾아 alloydb_password_validation이 포함되어 있는지 확인합니다. 그렇지 않으면 추가해야 합니다. 완료되면 shared_preload_libraries 줄이 다음과 같이 표시됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eAlloyDB Omni allows you to enhance security by setting password policies for users authenticating with the built-in password method.\u003c/p\u003e\n"],["\u003cp\u003ePassword policies are set by updating GUC password parameters in the \u003ccode\u003epostgresql.conf\u003c/code\u003e file, and these policies only affect passwords created or changed after the policy is set.\u003c/p\u003e\n"],["\u003cp\u003ePassword complexity can be enforced by ensuring passwords meet requirements for lowercase, uppercase, numeric, and non-alphanumeric characters, and have a minimum length, all configured via password policy flags.\u003c/p\u003e\n"],["\u003cp\u003ePassword expiration can be enforced, including setting a password's validity period and configuring notifications for users before their passwords expire, which can be managed through specific flags.\u003c/p\u003e\n"],["\u003cp\u003eYou can prevent the use of usernames within passwords by enabling a specific policy, which will reject any password attempt that includes the username as a substring.\u003c/p\u003e\n"]]],[],null,["# Manage built-in authentication using password policies\n\nSelect a documentation version: Current (16.8.0)keyboard_arrow_down\n\n- [Current (16.8.0)](/alloydb/omni/current/docs/manage-password-policy)\n- [16.8.0](/alloydb/omni/16.8.0/docs/manage-password-policy)\n- [16.3.0](/alloydb/omni/16.3.0/docs/manage-password-policy)\n- [15.12.0](/alloydb/omni/15.12.0/docs/manage-password-policy)\n- [15.7.1](/alloydb/omni/15.7.1/docs/manage-password-policy)\n- [15.7.0](/alloydb/omni/15.7.0/docs/manage-password-policy)\n- [15.5.5](/alloydb/omni/15.5.5/docs/manage-password-policy)\n\n\u003cbr /\u003e\n\nThis page describes how you can set and manage password policies for AlloyDB Omni.\n\n\u003cbr /\u003e\n\nAbout password policies\n-----------------------\n\nIf your application's database users authenticate with\nAlloyDB Omni using the built-in, password-based method,\nthen you can make authentication more secure by enforcing strong passwords. You\ncan define and enable password enforcement by\n[setting an AlloyDB Omni password policy](#set-password-policy).\n\n### Limitations of password policies\n\nAlloyDB Omni password policies have the following limitations:\n\n- Password policies apply to passwords created only after you set the policies.\n Existing user passwords aren't affected by a change in password policy.\n\n- Password policies apply to passwords entered only as plain text. Password\n policies don't apply to passwords entered as encrypted strings.\n\nSet an AlloyDB Omni password policy\n-----------------------------------\n\nYou set a password policy by updating Grand Unified Configuration (GUC) password\nparameters in your `postgresql.conf` configuration file. To learn how to set a\nGUC parameter, see\n[Configure AlloyDB Omni database flags](/alloydb/omni/current/docs/configure-database-flags).\n\nA password policy for AlloyDB Omni can include the following\noptions:\n\n- **Disallow username**: prevent the username from being used in the password.\n\n- **Password complexity**: check if the password contains the allowed number of\n lowercase, uppercase, numeric, and non-alphanumeric characters. Also check if\n the password length is valid.\n\n- **Password expiry**: make sure that passwords are rotated periodically.\n\nFor a list of the password policy flags that AlloyDB Omni\nsupports, see\n[Password policy flags](/alloydb/omni/current/docs/reference/password-policy-flags).\n\n### Preload the password validation library\n\nFor password a policy to take effect in AlloyDB Omni, the\n`alloydb_password_validation` library must be loaded. To load this library,\ndo the following:\n\n1. Locate the `postgresql.conf` configuration file for your installation of\n AlloyDB Omni and open it in a text editor.\n\n2. Locate the `shared_preload_libraries` line and check if it includes\n `alloydb_password_validation`. If it doesn't, then you need to add it. When\n finished, your `shared_preload_libraries` line looks similar to the\n following:\n\n shared_preload_libraries='google_columnar_engine,google_job_scheduler,google_storage,alloydb_password_validation'\n\n### Enforce password complexity\n\nTo enforce a password-complexity policy, do the following:\n\n1. Verify the your `postgresql.conf` file\n [preloads password validation library](#preload-password-db-library).\n\n2. Set the\n [`password.enforce_complexity`](/alloydb/omni/current/docs/reference/password-policy-flags#enforce_complexity)\n flag to `ON`.\n\n3. Use\n [password policy flags](/alloydb/omni/current/docs/reference/password-policy-flags) to\n define your password policy.\n\nFor example, to enforce a password policy that states a password must contain at\nleast one uppercase letter, one number, and be at least 10 characters long, you\nset the following in your `postgresql.conf` file:\n\n- `password.enforce_complexity = ON`\n- `password.min_uppercase_letters = 1`\n- `password.min_numerical_chars = 1`\n- `password.min_pass_length = 10`\n\nAfter these flags are set, an attempt to set a database user password that\ndoesn't comply with this password policy fails. For example, with this policy\nset, the following `psql` client command fails because the password `foo` is\nless than 10 characters and doesn't contain a number or an upper case character. \n\n CREATE USER \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eUSERNAME\u003c/span\u003e\u003c/var\u003e WITH PASSWORD foo;\n\n### Enforce password expiration\n\nTo enforce the password expiration policy, do the following:\n\n1. Verify the your `postgresql.conf` file\n [preloads password validation library](#preload-password-db-library).\n\n2. Set the\n [`password.enforce_expiration`](/alloydb/omni/current/docs/reference/password-policy-flags#enforce_expiration)\n flag to `ON`.\n\n3. Set the\n [`password.expiration_in_days`](/alloydb/omni/current/docs/reference/password-policy-flags#expiration_in_days)\n flag to the number of days after a password is set that it expires.\n\n4. Set the\n [`password.notify_expiration_in_days`](/alloydb/omni/current/docs/reference/password-policy-flags#notify_expiration_in_days)\n flag to the number of days before a password expires that a user starts\n receiving password expiration notifications.\n\nFor example, to enforce a password policy that states passwords expire after 30\ndays and that users are notified 15 days before their password expires, you must\nset the following in your `postgresql.conf` file:\n\n- `password.enforce_expiration = ON`\n- `password.expiration_in_days = 30`\n- `password.notify_expiration_in_days = 15`\n\nIf the password of a user expires, that user can't connect to\nAlloyDB Omni. To reset the password of a user, do the following:\n\n1. Connect to AlloyDB Omni using `psql`. For example, if you\n installed AlloyDB Omni using Docker, run the following\n command:\n\n docker exec -it \u003cvar translate=\"no\"\u003eCONTAINER-NAME\u003c/var\u003e psql -h localhost -U postgres\n\n2. At the `postgres=#` prompt, run the following command:\n\n ALTER USER \u003cvar translate=\"no\"\u003eUSERNAME\u003c/var\u003e WITH '\u003cvar translate=\"no\"\u003eNEW-PASSWORD\u003c/var\u003e';\n\nFor more information about changing a user's password, see\n[`ALTER ROLE`](https://www.postgresql.org/docs/current/sql-alterrole.html) in\nPostgreSQL documentation.\n\n### Don't allow usernames in passwords\n\nTo enforce the policy that prevents a password from containing a username, do\nthe following:\n\n1. Verify the your `postgresql.conf` file\n [preloads password validation library](#preload-password-db-library).\n\n2. Set the\n [`password.enforce_password_does_not_contain_username`](/alloydb/omni/current/docs/reference/password-policy-flags#enforce-password-does-not-contain-username) to `ON`.\n\nFor example, to ensure that a password doesn't contain a username as a\nsubstring, you set the following in your `postgresql.conf` file:\n\n- `password.enforce_password_does_not_contain_username = ON`\n\nIf this flag is set, then the following operation fails because the password\n`alex-secret` contains the username `alex`: \n\n CREATE USER alex WITH PASSWORD 'alex-secret';\n\nWhat's next\n-----------\n\n- Learn how to [backup and restore AlloyDB AlloyDB Omni](/alloydb/omni/current/docs/backup-overview)\n- [Create a read-only replica](/alloydb/omni/current/docs/set-up-read-replica)"]]
