PostgreSQL password_encryption setting impact on Automic Analytics

Products

• CA Automic Workload Automation - Automation Engine

Issue/Introduction

Security remediation reports may recommend changing the PostgreSQL password_encryption setting from md5 to scram-sha-256. This article provides information regarding the observations made during internal smoke testing of this configuration with Automic Analytics.

Environment

• Automic Analytics 24.x and higher
• PostgreSQL 10.x and higher

Resolution

Internal smoke testing on Analytics 24.x indicates that the application maintained connectivity when the PostgreSQL service was configured for scram-sha-256 encryption. Based on these observations, negative impacts on the Analytics components themselves are not anticipated.

Important Support and Compatibility Considerations:

• Official Support: These findings do not indicate official support or certified compatibility for scram-sha-256 unless it is explicitly listed in the product documentation or the Compatibility Matrix.
• Customer Responsibility: You must perform a thorough evaluation and testing of this change in a non-production environment. This ensures that localized network configurations, specific drivers, or PostgreSQL version behaviors are fully accounted for.
• Implementation: Broadcom Support does not provide implementation steps for database-level hardening. Coordinate with a Database Administrator (DBA) for changes to the postgresql.conf file.

If further assistance is required to understand these observations, see Contact Broadcom Support.

 

Additional Information

• Refer to the Automic Compatibility Matrix for the most current list of officially certified database configurations.
• See the official PostgreSQL Documentation for technical details on authentication methods.