使用Hashcorp Vault密码更新npgsql池连接

Question

I am looking into using Hashicorp's Vault software for managing Postgres database passwords utilizing the VaultSharp postgresql secret backend in my C# web service applications.

These applications connect to a PostgreSql server using a database pool with persistent connections.

My understanding is that in this setup, Vault will dynamically generate and revoke database usernames and passwords that were provided to my application.

However what I am not clear on, is there an automated way for my application to dynamically reauthenticate to the database server before the lease expires? Or do I need to manually manage my persistent database connections and manually disconnect / reconnect them before the lease expires?

I'm hoping that this would be a feature in npgsql or a similar database driver that can handle this for me, or if there is a way to reauthenticate with a new username and password on an existing connection.

Answer 1

The PostgreSQL protocol doesn't allow reauthenticating an existing connection - authentication happens only when first opening a connection, in the Startup packet. For more information see the protocol docs . So you're going to have to close your current connection(s) and open new one(s).

You can force Npgsql to clear all existing idle connections in the pool by calling NpgsqlConnection.ClearPool() or ClearAllPools() . However, this will not affect any connections currently in use in your application - there's no way to close them on the fly (this would cause an exception the next time the connection were used).

In theory, it's possible to develop a feature which would "replace" the authentication information for existing connections. This would set a flag on all in-use connections that would trigger a transparent close and reconnect the next time the connection is used. However, this would be a pretty complicated and error-prone feature.