Hiding password of PostGIS layer in QGIS Plugin

It depends on what is your final purpose.

• Plugin writers must use publicSource

It seems you need to display the source of the layer within your plugin. So you can use QgsMapLayer.publicSource() instead of QgsMapLayer.source().

Gets a version of the internal layer definition that has sensitive bits removed (for example, the password). This function should be used when displaying the source name for general viewing.

https://qgis.org/api/classQgsMapLayer.html#a2da43913a3a0ed20b4873b2276e2e7f9

• The user must use the authentication system when they add layers in QGIS

When the user is adding a layer, there is warning from QGIS saying that password and user are stored in the project. This is a security issue.

But the user should use the Authentification System provided in QGIS: https://docs.qgis.org/2.14/en/docs/user_manual/auth_system/auth_overview.html

For example, I'm adding the same layer with these two different methods. First by adding my credentials following my first screenshot. I got the warning from QGIS about password. Then I added the layer again with the authentification system (cf the second screenshot above):

iface.activeLayer().source()
u'dbname='stdm' host=localhost port=5433 user='etienne' password='etienne' sslmode=disable key='id' srid=4326 type=MultiPolygon table="public"."buildings" (geom) sql='
iface.activeLayer().source()
u'dbname='stdm' host=localhost port=5433 sslmode=disable authcfg=1363gs5 key='id' srid=4326 type=MultiPolygon table="public"."buildings" (geom) sql='

My password is not there anymore.

This PyQGIS code finally worked:

def getURI(self):
    uri = QgsDataSourceURI()
    uri.setConnection(self.host,self.port , self.database, "","", QgsDataSourceURI.SSLdisable,"")
    configId='nnnID'
    self.initAuthManager(configId)
    uri.setAuthConfigId(configId)
    return uri


def initAuthManager(self,configId):
    self.AUTHDB_MASTERPWD = 'yourPluginId'
    if self.am==None:
        self.am=QgsAuthManager().instance()
    if not self.am.masterPasswordHashInDb():
        self.am.setMasterPassword(self.AUTHDB_MASTERPWD, True)
        self.am.authenticationDbPath()
        self.am.masterPasswordIsSet()
       
    cfg = QgsAuthMethodConfig()
    cfg.setId(configId)
    cfg.setName('yourPluginName')
    cfg.setMethod('Basic')
    cfg.setConfig('username', "secretuser")
    cfg.setConfig('password', "secretpassword")
    self.am.storeAuthenticationConfig(cfg)

def insertLayer(self):
    uri= self.getURI
    vlayer = QgsVectorLayer(uri.uri(False), table,'postgres')
    QgsMapLayerRegistry.instance().addMapLayer(vlayer,True)