Kratos can not parse postgresql password which has special characters

[monkjunior]

Hi,

I am learning Kratos. After checkout the quickstart, I want to change the setup a little bit by using PostgreSQL. Then I got a problem that Kratos can not parse dsn which contains special characters.

Password in the example: (A?(+8CJAr5&4gk$L)

INFO[2021-08-18T15:45:49+07:00] No tracer configured - skipping tracing setup  audience=application service_name=Ory Kratos service_version=v0.7.1-alpha.1
WARN[2021-08-18T15:45:49+07:00] Unable to connect to database, retrying.      audience=application error=map[message:cannot parse `postgres://root:[email protected]:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4`: faile
d to parse as URL (parse "postgres://root:(A?(+8CJAr5&4gk$L)@127.0.0.1:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4": invalid port ":(A" after host)] service_name=Ory Kratos service_version=v0.7.1-alpha.1

I worked around using a simpler password but I still wonder that do we have any way to set up DSN to work with a complex password ?

Thanks.

[vinckr]

Sorry for the late response @monkjunior
I just tried to reproduce this and I can create accounts with your example password or such as:

!"§$%&/()=?)?=?"!"=$§"$""

This is probably a different problem on your end. Let me know if you are still stuck on this, marking as answered in the meantime.

[process-pca]

The password that is failing for us has a "[" square bracket in it

[vinckr]

Hello @process-pca

I can't reproduce this - just created an account with password {{[][[][][][]]}} on my demo instance without any issues.

What version of Kratos are you running?

[process-pca]

I am sorry I was not more specific... the issue is manifesting between the helm chart and the building of the DSN. In my case I have secrets rotation being managed by AWS RDS (so frustratingly I can not just change my password 😄) and I am using the CSI secrets driver to populate env variables that I am templating into a composed DSN variable I know it works when I URLEncode the password, in my case it makes 3 replacements after which it works just fine 👍 (I just have yet to figure out how to do it automatically in my pipeline) In my case it replaces "*" "[" and "<" and after that it validates correctly

The exact error I end up with before encoding the password is:

{"audience":"application","error":{"message":"cannot parse postgres://master:xxxxxx@[REDACTED]/ory: failed to parse as URL (parse "postgres://master:[REDACTED]@[REDACTED]:5432/ory": net/url: invalid userinfo)","stack_trace":"stack trace could not be recovered from error type *pgconn.parseConfigError"},"file":"/go/pkg/mod/github.com/ory/[email protected]/logrusx/helper.go:141","func":"github.com/ory/x/logrusx.(*Logger).Logf","level":"warning","msg":"Unable to connect to database, retrying.","service_name":"Ory Kratos","service_version":"v1.3.1","time":"2024-12-30T09:02:18.898552111Z"}

  extraEnv:
    # Environment variables for PostgreSQL credentials
    - name: POSTGRES_USER
      valueFrom:
        secretKeyRef:
          name: rds-secrets
          key: username

    - name: POSTGRES_DB
      value: ory

    - name: POSTGRES_HOST
      value: <DBHOST> # Hostname of the RDS instance

    - name: POSTGRES_PASSWORD
      valueFrom:
        secretKeyRef:
          name: rds-secrets
          key: password

    - name: DSN
      value: postgresql://$(POSTGRES_USER):$(POSTGRES_PASSWORD)@$(POSTGRES_HOST):5432/ory"

[vinckr]

I see, thanks @process-pca

for basic auth Ory uses URL encoding, so you need to URL encode the password - somewhat related: https://www.ory.sh/docs/troubleshooting/smtp-courier-OTA-112022-01