pgsql: oauth: Don't log discovery connections by default

From: Jacob Champion <jchampion(at)postgresql(dot)org>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: oauth: Don't log discovery connections by default
Date: 2026-03-31 18:49:28
Message-ID: E1w7e9X-002LfC-2Y@gemulon.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

oauth: Don't log discovery connections by default

Currently, when the client sends a parameter discovery request within
OAUTHBEARER, the server logs the attempt with

FATAL: OAuth bearer authentication failed for user

These log entries are difficult to distinguish from true authentication
failures, and by default, libpq sends a discovery request as part of
every OAuth connection, making them annoyingly noisy. Use the new
PG_SASL_EXCHANGE_ABANDONED status to suppress them.

Patch by Zsolt Parragi, with some additional comments added by me.

Author: Zsolt Parragi <zsolt(dot)parragi(at)percona(dot)com>
Reviewed-by: Andrey Borodin <x4mmm(at)yandex-team(dot)ru>
Reviewed-by: Chao Li <li(dot)evan(dot)chao(at)gmail(dot)com>
Discussion: https://postgr.es/m/CAN4CZFPim7hUiyb7daNKQPSZ8CvQRBGkVhbvED7yZi8VktSn4Q%40mail.gmail.com

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/e020a897efeaed52cd3f5fef7f933cb5dc6cbfaf

Modified Files
--------------
src/backend/libpq/auth-oauth.c | 45 ++++++++++++++++--------
src/test/modules/oauth_validator/t/001_server.pl | 6 ++--
2 files changed, 34 insertions(+), 17 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Melanie Plageman 2026-03-31 19:05:44 pgsql: Fix test_aio read_buffers() to work without cassert
Previous Message Nathan Bossart 2026-03-31 17:44:31 pgsql: Avoid including vacuum.h in tableam.h and heapam.h.