DBeaver Master Password and PostgreSQL Credential Rotation Interoperability

Question

DBeaver utilizes a master password to encrypt stored connection credentials via AES-256, preventing clear-text exposure in the global preferences file. This mechanism secures the local storage of credentials before they are forwarded via the JDBC driver to the database's native authentication subsystem.

A challenge arises when credentials are rotated or expire on the PostgreSQL server independently of the DBeaver client. Because the tool relies on the encrypted local store to initiate the handshake, there is no native trigger to synchronize these changes without manual user intervention.

Given this architecture, what is the expected behavior when a PostgreSQL password expires while DBeaver is configured with a master password? Does the JDBC driver provide a mechanism to signal the client to prompt for new credentials, or must the encrypted store be manually updated for every affected connection?

Tasadduq Burney · Answer

Expected Behavior
When a PostgreSQL password expires or is rotated on the server, DBeaver will not automatically synchronize this change. Because the master password only secures the local storage of the credential and does not create a live link to the server's identity management, the client remains unaware of the expiration until a connection attempt is made.

The expected behavior is a connection failure. The JDBC driver will receive an authentication error from the PostgreSQL server and pass this back to DBeaver. DBeaver will then display a standard error dialog indicating an authentication failure (typically FATAL: password authentication failed for user), but it will not trigger a specialized "password expired" prompt to update the encrypted store.

Technical Explanation
The interoperability gap exists because of the separation between the encryption layer and the transport layer:

Encryption Layer: The master password is used solely to encrypt/decrypt the credentials stored in the local preferences file via AES-256.
  Transport Layer: The JDBC driver sends the decrypted password to the server. If the server rejects the password due to expiration, the JDBC driver treats this as a generic authentication failure.

There is currently no native mechanism within the standard PostgreSQL JDBC driver to signal a specific "credential rotation required" state that DBeaver can use to automatically trigger a credential update workflow.

Resolution Steps
To restore connectivity after a password rotation, you must manually update the encrypted store:

Right-click the affected connection in the Database Navigator.
  Select Edit Connection.
  In the Connection settings window, enter the new password in the password field.
  Click OK. DBeaver will use your master password to re-encrypt the new credential and save it to the local preferences.

Verification
To confirm the cause of the failure, check the DBeaver error log via Window > Show View > Other... > DBeaver Log. Look for the specific PostgreSQL FATAL error code associated with the failed handshake.

Diagnostic Detail Needed: Are you using a specific authentication plugin (e.g., GSSAPI, LDAP, or Active Directory) via the JDBC driver, or are you using standard PostgreSQL password authentication?

DBeaver Master Password and PostgreSQL Credential Rotation Interoperability

1 answer

Expected Behavior

Technical Explanation

Resolution Steps

Verification

Your perspective belongs here.

0 question comments