password_passthrough param doesn't work?

[xSP1TFIREx]

Hello everyone! Can you help me with the following question? I can't figure out what I'm setting up incorrectly.

The problem:
We need to use Odyssey to manage and control database connections.
It should not:

• Store user passwords
• Use any technical records to work with the database
  In other words, when connecting to it, it should prompt users for a password and then proxy it to the database for authorization.

What's been done:
A clear test server with PostgreSQL 17 (172.30.68.186) and a separate server with Odyssey 1.5.0 (172.30.68.140) running in a container.
The following configuration was applied to Odyssey:

storage "postgres" {
    type "remote"
    host "172.30.68.186"
    port 5432
}

database default {
    user default {
        authentication "md5"
        password_passthrough yes
        password ""
        storage "postgres"
        pool "session"
        }
}

With this configuration, it asks for a password but returns an error.
Client-side error:
psql: error: connection to server at "172.30.68.140", port 6432 failed: FATAL: odyssey: c31bad302700d: password authentication failed for user "airflow"

Error in server logs:

7 2026-02-06T10:42:37Z info [c31bad302700d none] (startup) new client connection 172.30.68.101:35364
7 2026-02-06T10:42:37Z debug [c31bad302700d none] (tls) ssl request
7 2026-02-06T10:42:37Z debug [c31bad302700d none] (tls) is disabled, ignoring
7 2026-02-06T10:42:37Z debug [none none] (routing) matching rule: default_db default_user all with client visible routing type to external client
7 2026-02-06T10:42:37Z info [c31bad302700d none] (startup) route 'airflow.airflow' to 'default_db.default_user'
7 2026-02-06T10:42:37Z debug [c31bad302700d none] (auth) PasswordMessage
7 2026-02-06T10:42:37Z info [c31bad302700d none] (auth) user 'airflow.airflow' incorrect password
7 2026-02-06T10:42:37Z info [c31bad302700d none] (auth) ip '172.30.68.101' user 'airflow.airflow': host based authentication allowed

The account is definitely working—a direct connection to the database has been tested. The password parameter is really confusing. It can't be omitted, so I leave it blank. If I enter the correct password, I can log in. So, it seems Odyssey isn't ignoring this blank password, it's either sending it to the server or comparing it with the password entered.

I tried both md5 and clear_text but everytime the container won't start until I specify password param.
With the following config the container won't even start:

storage "postgres" {
    type "remote"
    host "172.30.68.186"
    port 5432
}

database default {
    user default {
        authentication "clear_text"
        password_passthrough yes
        storage "postgres"
        pool "session"
        }
}

Am I doing something wrong or it's just a bug in this release?
Thanks in advance!

[NyaMisty]

exactly same issue

[punkpeye]

Is this broken on all versions or is this a regression?

[rkhapov]

hi all!

i dont fully understand: what do you expect from password_passthrough option?

it will not allow to just bypass the password check and make it at PG side, because it is how the poolers works: the backend connections are already opened in waste majority of cases for new client connections, so startup can not be performed

this option is generally need for ldap and external authentication

if you dont want to specify password in odyssey config, maybe you can use auth_query?

[punkpeye]

I ended up using auth_query. That worked. Thank you

[NyaMisty]

auth_query is totally unacceptable. So I switched to PgDog which offers real password passthrough in TLS connection.