docs: add IvorySQL 5 passwordcheck adaptation guide

CN/modules/ROOT/nav.adoc

@@ -76,6 +76,7 @@
 *** xref:master/ecosystem_components/zhparser.adoc[zhparser]
 *** xref:master/ecosystem_components/pgbackrest.adoc[pgBackRest]
 *** xref:master/ecosystem_components/set_user.adoc[set_user]
+*** xref:master/ecosystem_components/passwordcheck.adoc[passwordcheck]
 * 监控运维
 ** xref:master/getting-started/daily_monitoring.adoc[日常监控]
 ** xref:master/getting-started/daily_maintenance.adoc[日常维护]

CN/modules/ROOT/pages/master/ecosystem_components/ecosystem_overview.adoc

@@ -41,6 +41,7 @@ IvorySQL 作为一款兼容 Oracle 且基于 PostgreSQL 的高级开源数据库
 | 28 | xref:master/ecosystem_components/zhparser.adoc[zhparser] | master branch | 用于中文全文搜索的PostgreSQL插件，基于SCWS（即：简易中文分词系统）实现了一个中文解析器 | 搜索引擎、关键字提取
 | 29 | xref:master/ecosystem_components/pgbackrest.adoc[pgBackRest] | 2.58.0 | 可靠的 PostgreSQL 备份和恢复解决方案 | 容灾备份、大库备份、异地/多层容灾
 | 30 | xref:master/ecosystem_components/set_user.adoc[set_user] | REL4_2_0 | PostgreSQL 安全审计扩展，可控角色切换，支持白名单、强制审计、拦截高危操作 | 可控角色切换、权限管理、审计日志
+| 31 | xref:master/ecosystem_components/passwordcheck.adoc[passwordcheck] | IvorySQL 5.6 | 在创建或修改角色时执行基础密码策略 | 账户安全、开发与测试环境
 |====
 
 这些插件均经过 IvorySQL 团队的测试和适配，确保在 IvorySQL 环境下稳定运行。用户可以根据业务需求选择合适的插件，进一步提升数据库系统的能力和灵活性。

CN/modules/ROOT/pages/master/ecosystem_components/passwordcheck.adoc

@@ -0,0 +1,76 @@
+:sectnums:
+:sectnumlevels: 5
+
+= passwordcheck
+
+== 概述
+
+`passwordcheck` 是 IvorySQL 源码自带的可加载模块。当 `CREATE ROLE`、`CREATE USER` 或 `ALTER ROLE` 接收到明文密码时，它会拒绝弱密码。该模块适合作为轻量级基础策略；如需字典检查、密码历史或集中式身份策略，应使用专门的认证系统。
+
+本文在 x86_64 Linux 上使用 IvorySQL 5.6（PostgreSQL 18.6）完成验证，模块自带的 PostgreSQL 和 Oracle 兼容模式回归测试均通过。
+
+== 编译安装
+
+[source,bash]
+----
+git clone https://github.com/IvorySQL/IvorySQL.git
+cd IvorySQL
+git checkout IVORY_REL_5_STABLE
+cd contrib/passwordcheck
+make USE_PGXS=1 PG_CONFIG=/path-to/ivorysql/bin/pg_config
+sudo make USE_PGXS=1 PG_CONFIG=/path-to/ivorysql/bin/pg_config install
+----
+
+`passwordcheck` 是可加载模块而不是 SQL 扩展，因此不需要执行 `CREATE EXTENSION`。
+
+== 配置
+
+如需在所有连接中一致执行密码策略，请在 `ivorysql.conf` 中保留原有条目并把模块追加到 `shared_preload_libraries`，然后重启 IvorySQL。例如：
+
+[source,conf]
+----
+shared_preload_libraries = 'liboracle_parser, ivorysql_ora, passwordcheck'
+----
+
+超级用户也可在当前会话执行 `LOAD 'passwordcheck';` 临时测试。
+
+最小长度默认为 8 字节。以下超级用户命令会修改整个实例的设置：
+
+[source,sql]
+----
+SHOW passwordcheck.min_password_length;
+ALTER SYSTEM SET passwordcheck.min_password_length = 12;
+SELECT pg_reload_conf();
+----
+
+== 功能验证
+
+[source,sql]
+----
+-- 拒绝：长度过短。
+CREATE ROLE weak_user LOGIN PASSWORD 'a1!';
+-- 拒绝：包含角色名。
+CREATE ROLE app_user LOGIN PASSWORD 'app_user-2026!';
+-- 通过：长度足够，同时包含字母和非字母字符。
+CREATE ROLE app_user LOGIN PASSWORD 'Blue-River-2026!';
+ALTER ROLE app_user PASSWORD 'Green-Bridge-2027!';
+DROP ROLE app_user;
+----
+
+在 IvorySQL 编译树中运行自带测试：
+
+[source,bash]
+----
+cd contrib/passwordcheck
+PGPORT=5432 make installcheck
+PGPORT=1521 make oracle-installcheck
+----
+
+== 限制与安全说明
+
+* 长度参数计算的是编码后的字节数，而不是用户感知的字符数。
+* 明文密码必须达到最小长度、不能包含角色名，并且必须同时包含字母和非字母字符。
+* 如果服务器收到的是预加密密码，模块无法检查原始密码复杂度。如必须由服务端执行复杂度检查，应通过加密连接提交明文密码变更。
+* 会话级 `LOAD` 只保护当前会话；必须覆盖所有连接时应全局加载模块。
+
+实现细节请参阅 https://github.com/IvorySQL/IvorySQL/tree/IVORY_REL_5_STABLE/contrib/passwordcheck[passwordcheck 源码目录]。

EN/modules/ROOT/nav.adoc

@@ -76,6 +76,7 @@
 *** xref:master/ecosystem_components/zhparser_en.adoc[zhparser]
 *** xref:master/ecosystem_components/pgbackrest.adoc[pgBackRest]
 *** xref:master/ecosystem_components/set_user.adoc[set_user]
+*** xref:master/ecosystem_components/passwordcheck.adoc[passwordcheck]
 * Monitor and O&M
 ** xref:master/getting-started/daily_monitoring.adoc[Monitoring]
 ** xref:master/getting-started/daily_maintenance.adoc[Maintenance]

EN/modules/ROOT/pages/master/ecosystem_components/ecosystem_overview.adoc

@@ -42,6 +42,7 @@ IvorySQL, as an advanced open-source database compatible with Oracle and based o
 |*28*| xref:master/ecosystem_components/zhparser_en.adoc[zhparser] | master branch | PostgreSQL extension for full-text search of Chinese language (Mandarin Chinese). It implements a Chinese language parser base on the | Search engine、keyword extraction
 |*29*| xref:master/ecosystem_components/pgbackrest.adoc[pgBackRest] | 2.58.0 | pgBackRest is a reliable backup and restore solution for PostgreSQL that seamlessly scales up to the largest databases and workloads | Disaster recovery backup, large database backup, off-site/multi-tier disaster recovery
 | *30* | xref:master/ecosystem_components/set_user.adoc[set_user] | REL4_2_0 | PostgreSQL security auditing extension with controlled role switching, supporting allowlists, enforced auditing, and blocking of high-risk operations | Controlled role switching, privilege management, audit logging
+| *31* | xref:master/ecosystem_components/passwordcheck.adoc[passwordcheck] | IvorySQL 5.6 | Enforces a baseline password policy when roles are created or altered | Account security, development and test environments
 |====
 
 These plugins have all been tested and adapted by the IvorySQL team to ensure stable operation in the IvorySQL environment. Users can select appropriate plugins based on business needs to further enhance the capabilities and flexibility of the database system.

EN/modules/ROOT/pages/master/ecosystem_components/passwordcheck.adoc

@@ -0,0 +1,76 @@
+:sectnums:
+:sectnumlevels: 5
+
+= passwordcheck
+
+== Overview
+
+`passwordcheck` is a module shipped with the IvorySQL source tree. It rejects weak passwords when the server receives a plaintext password from `CREATE ROLE`, `CREATE USER`, or `ALTER ROLE`. It is a lightweight baseline policy; deployments that need dictionary checks, password history, or centralized identity policy should use a dedicated authentication system.
+
+This guide was validated with IvorySQL 5.6 (PostgreSQL 18.6) on x86_64 Linux. The bundled PostgreSQL and Oracle-compatible regression tests both passed.
+
+== Build and install
+
+[source,bash]
+----
+git clone https://github.com/IvorySQL/IvorySQL.git
+cd IvorySQL
+git checkout IVORY_REL_5_STABLE
+cd contrib/passwordcheck
+make USE_PGXS=1 PG_CONFIG=/path-to/ivorysql/bin/pg_config
+sudo make USE_PGXS=1 PG_CONFIG=/path-to/ivorysql/bin/pg_config install
+----
+
+`passwordcheck` is a loadable module, not a SQL extension, so do not run `CREATE EXTENSION`.
+
+== Configuration
+
+For consistent enforcement, append the module to `shared_preload_libraries` in `ivorysql.conf`, retaining any existing entries, and restart IvorySQL. For example:
+
+[source,conf]
+----
+shared_preload_libraries = 'liboracle_parser, ivorysql_ora, passwordcheck'
+----
+
+For a temporary test, a superuser can run `LOAD 'passwordcheck';` in one session.
+
+The minimum length defaults to 8 bytes. The following superuser command changes it for the whole instance:
+
+[source,sql]
+----
+SHOW passwordcheck.min_password_length;
+ALTER SYSTEM SET passwordcheck.min_password_length = 12;
+SELECT pg_reload_conf();
+----
+
+== Validation
+
+[source,sql]
+----
+-- Rejected: too short.
+CREATE ROLE weak_user LOGIN PASSWORD 'a1!';
+-- Rejected: contains the role name.
+CREATE ROLE app_user LOGIN PASSWORD 'app_user-2026!';
+-- Accepted: long enough and contains letters and non-letters.
+CREATE ROLE app_user LOGIN PASSWORD 'Blue-River-2026!';
+ALTER ROLE app_user PASSWORD 'Green-Bridge-2027!';
+DROP ROLE app_user;
+----
+
+Run the bundled tests from an IvorySQL build tree:
+
+[source,bash]
+----
+cd contrib/passwordcheck
+PGPORT=5432 make installcheck
+PGPORT=1521 make oracle-installcheck
+----
+
+== Limitations and security notes
+
+* The length setting counts encoded bytes, not user-perceived characters.
+* Plaintext passwords must meet the minimum length, must not contain the role name, and must contain both letters and non-letters.
+* If the server receives a pre-encrypted password, the module cannot inspect its original complexity. Require plaintext password changes over an encrypted connection if server-side complexity enforcement is mandatory.
+* A session-level `LOAD` protects only that session; load the module globally when the policy must apply to every connection.
+
+For implementation details, see https://github.com/IvorySQL/IvorySQL/tree/IVORY_REL_5_STABLE/contrib/passwordcheck[the passwordcheck source directory].