pgsql: oauth: Recheck oauth_validator_libraries during authentication

From: Daniel Gustafsson <dgustafsson(at)postgresql(dot)org>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: oauth: Recheck oauth_validator_libraries during authentication
Date: 2026-11-05 13:16:14
Message-ID: E1xOxKA-00000000Jbk-1C2w@gemulon.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

oauth: Recheck oauth_validator_libraries during authentication

The validator allowlist is only enforced while parsing pg_hba.conf.
If changing oauth_validator_libraries makes an existing oauth line
invalid, the HBA reload fails and the old lines stay in use, so a
removed validator keeps authenticating users. In particular, when
setting the list to the empty string, the server doesn't refuse an
OAuth connection, as documented.

Backpatch down to v18 where OAuth was introduced.

Author: Zsolt Parragi <zsolt(dot)parragi(at)percona(dot)com>
Reviewed-by: Daniel Gustafsson <daniel(at)yesql(dot)se>
Reviewed-by: shihao zhong <zhong950419(at)gmail(dot)com>
Discussion: https://postgr.es/m/CAN4CZFNbWXwC=s4t9Xu1kitLsQvTe-EwpVtFCjixWCHBxRTraQ@mail.gmail.com
Backpatch-through: 18

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/e352ac8c5c90ed6ce792f044c22145578542a330

Modified Files
--------------
src/backend/libpq/auth-oauth.c | 14 ++++++++++++++
src/test/modules/oauth_validator/t/001_server.pl | 18 ++++++++++++++++++
2 files changed, 32 insertions(+)

Browse pgsql-committers by date

  From Date Subject
Next Message Daniel Gustafsson 2026-11-05 13:16:49 pgsql: oauth: Recheck oauth_validator_libraries during authentication
Previous Message Heikki Linnakangas 2026-11-05 11:58:11 pgsql: Use branchless comparisons in btint4cmp and btint8cmp, for speed