| From: | Daniel Gustafsson <dgustafsson(at)postgresql(dot)org> |
|---|---|
| To: | pgsql-committers(at)lists(dot)postgresql(dot)org |
| Subject: | pgsql: oauth: Recheck oauth_validator_libraries during authentication |
| Date: | 2026-11-05 13:16:14 |
| Message-ID: | E1xOxKA-00000000Jbk-1C2w@gemulon.postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-committers |
oauth: Recheck oauth_validator_libraries during authentication
The validator allowlist is only enforced while parsing pg_hba.conf.
If changing oauth_validator_libraries makes an existing oauth line
invalid, the HBA reload fails and the old lines stay in use, so a
removed validator keeps authenticating users. In particular, when
setting the list to the empty string, the server doesn't refuse an
OAuth connection, as documented.
Backpatch down to v18 where OAuth was introduced.
Author: Zsolt Parragi <zsolt(dot)parragi(at)percona(dot)com>
Reviewed-by: Daniel Gustafsson <daniel(at)yesql(dot)se>
Reviewed-by: shihao zhong <zhong950419(at)gmail(dot)com>
Discussion: https://postgr.es/m/CAN4CZFNbWXwC=s4t9Xu1kitLsQvTe-EwpVtFCjixWCHBxRTraQ@mail.gmail.com
Backpatch-through: 18
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/e352ac8c5c90ed6ce792f044c22145578542a330
Modified Files
--------------
src/backend/libpq/auth-oauth.c | 14 ++++++++++++++
src/test/modules/oauth_validator/t/001_server.pl | 18 ++++++++++++++++++
2 files changed, 32 insertions(+)
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Daniel Gustafsson | 2026-11-05 13:16:49 | pgsql: oauth: Recheck oauth_validator_libraries during authentication |
| Previous Message | Heikki Linnakangas | 2026-11-05 11:58:11 | pgsql: Use branchless comparisons in btint4cmp and btint8cmp, for speed |