Re: Emptying oauth_validator_libraries doesn't stop OAuth logins

> On 10 Oct 2026, at 11:57, Zsolt Parragi <zsolt(dot)parragi(at)percona(dot)com> wrote:

Sorry for being slow to get to this, working through the backlog of bugs in the
inbox now.

> The attached patch calls check_oauth_validator() again in
> oauth_init(), before loading the library, and fails the authentication
> if the validator isn't permitted anymore. Only logins on affected
> oauth lines fail, everything else keeps working with the old HBA lines
> as before.

Thanks for the patch, I agree that the current behaviour is incorrect wrt the
docs and we should fix this down to v18.

+ if (!check_oauth_validator(port->hba, LOG, &err_msg))
+ ereport(ERROR,

Since check_oauth_validator already performs error logging, why not let it
handle erroring out with a higher elevel than LOG? Also, we should be using
COMMERROR here to keep details from bleeding through during authentication.
The attached v2 implements this, thoughts on that?

Another option would be a larger refactoring to move this re-checking into
load_validator_library() to make sure it cannot bypass due to programmer error,
but for a backpatchable fix I think the current approach is better.

--
Daniel Gustafsson