| From: | Daniel Gustafsson <dgustafsson(at)postgresql(dot)org> |
|---|---|
| To: | pgsql-committers(at)lists(dot)postgresql(dot)org |
| Subject: | pgsql: oauth: Recheck oauth_validator_libraries during authentication |
| Date: | 2026-11-05 13:16:59 |
| Message-ID: | E1xOxKt-00000000Je7-1tYm@gemulon.postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-committers |
oauth: Recheck oauth_validator_libraries during authentication
The validator allowlist is only enforced while parsing pg_hba.conf.
If changing oauth_validator_libraries makes an existing oauth line
invalid, the HBA reload fails and the old lines stay in use, so a
removed validator keeps authenticating users. In particular, when
setting the list to the empty string, the server doesn't refuse an
OAuth connection, as documented.
Backpatch down to v18 where OAuth was introduced.
Author: Zsolt Parragi <zsolt(dot)parragi(at)percona(dot)com>
Reviewed-by: Daniel Gustafsson <daniel(at)yesql(dot)se>
Reviewed-by: shihao zhong <zhong950419(at)gmail(dot)com>
Discussion: https://postgr.es/m/CAN4CZFNbWXwC=s4t9Xu1kitLsQvTe-EwpVtFCjixWCHBxRTraQ@mail.gmail.com
Backpatch-through: 18
Branch
------
REL_18_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/8e54a414570010afed0b8b1ed10882afba380166
Modified Files
--------------
src/backend/libpq/auth-oauth.c | 14 ++++++++++++++
src/test/modules/oauth_validator/t/001_server.pl | 16 ++++++++++++++++
2 files changed, 30 insertions(+)
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tomas Vondra | 2026-11-05 14:51:07 | pgsql: Handle numeric overflow when handling range values |
| Previous Message | Daniel Gustafsson | 2026-11-05 13:16:49 | pgsql: oauth: Recheck oauth_validator_libraries during authentication |