Magnus Hagander <magnus@hagander.net> writes:
> I am unsure of exactly where this thing hacks into the authentication
> stream, but is it really only MD5 that fails?
The problem with md5 is that the username is part of the encryption salt
for the stored password, so changing it breaks that --- the client will
hash the password with what it thinks the username is, but the stored
password in pg_authid is hashed with what the server thinks the username
is.
You might be right that some other auth methods have an issue too,
but md5 is the only one anyone's ever reported a problem with. That
might or might not just represent lack of testing.
regards, tom lane