| From: | Daniel Gustafsson <dgustafsson(at)postgresql(dot)org> |
|---|---|
| To: | pgsql-committers(at)lists(dot)postgresql(dot)org |
| Subject: | pgsql: oauth: Recheck oauth_validator_libraries during authentication |
| Date: | 2026-11-05 13:16:49 |
| Message-ID: | E1xOxKj-00000000JdP-2d6T@gemulon.postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-committers |
oauth: Recheck oauth_validator_libraries during authentication
The validator allowlist is only enforced while parsing pg_hba.conf.
If changing oauth_validator_libraries makes an existing oauth line
invalid, the HBA reload fails and the old lines stay in use, so a
removed validator keeps authenticating users. In particular, when
setting the list to the empty string, the server doesn't refuse an
OAuth connection, as documented.
Backpatch down to v18 where OAuth was introduced.
Author: Zsolt Parragi <zsolt(dot)parragi(at)percona(dot)com>
Reviewed-by: Daniel Gustafsson <daniel(at)yesql(dot)se>
Reviewed-by: shihao zhong <zhong950419(at)gmail(dot)com>
Discussion: https://postgr.es/m/CAN4CZFNbWXwC=s4t9Xu1kitLsQvTe-EwpVtFCjixWCHBxRTraQ@mail.gmail.com
Backpatch-through: 18
Branch
------
REL_19_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/c38de3ae6098ccf1904109f2e550eb4777f66024
Modified Files
--------------
src/backend/libpq/auth-oauth.c | 14 ++++++++++++++
src/test/modules/oauth_validator/t/001_server.pl | 18 ++++++++++++++++++
2 files changed, 32 insertions(+)
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Daniel Gustafsson | 2026-11-05 13:16:59 | pgsql: oauth: Recheck oauth_validator_libraries during authentication |
| Previous Message | Daniel Gustafsson | 2026-11-05 13:16:14 | pgsql: oauth: Recheck oauth_validator_libraries during authentication |