From 96bc4e83b40feaf747871081a48350991bd5b5f3 Mon Sep 17 00:00:00 2001 From: Jeff Davis Date: Tue, 28 Jul 2026 13:50:29 -0700 Subject: [PATCH v2 3/3] postgres_fdw: reject use_scram_passthrough for subscriptions. The subscription is initiated from a loical replication worker, so SCRAM pass-through won't work. Resolves finding 3 in report. Reported-by: Noah Misch Discussion: https://postgr.es/m/20260710195902.4f.noahmisch@microsoft.com Backpatch-through: 19 --- contrib/postgres_fdw/connection.c | 12 ++++++++++++ contrib/postgres_fdw/t/010_subscription.pl | 14 +++++++++++++- doc/src/sgml/postgres-fdw.sgml | 7 +++++++ 3 files changed, 32 insertions(+), 1 deletion(-) diff --git a/contrib/postgres_fdw/connection.c b/contrib/postgres_fdw/connection.c index aab21695979..094eac2f343 100644 --- a/contrib/postgres_fdw/connection.c +++ b/contrib/postgres_fdw/connection.c @@ -2479,6 +2479,18 @@ postgres_fdw_connection(PG_FUNCTION_ARGS) char *appname; char *sep = ""; + /* + * SCRAM pass-through cannot work for subscriptions because the connection + * happens in a worker process. + */ + if (UseScramPassthrough(server, user)) + ereport(ERROR, + (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), + errmsg("SCRAM pass-through authentication is not supported for subscription connections"), + errdetail("The foreign server or user mapping for user \"%s\" has \"use_scram_passthrough\" enabled.", + GetUserNameFromId(userid, false)), + errhint("Store a password in the user mapping instead."))); + construct_connection_params(server, user, &keywords, &values, &appname); initStringInfo(&str); diff --git a/contrib/postgres_fdw/t/010_subscription.pl b/contrib/postgres_fdw/t/010_subscription.pl index c34b3d15b8d..53f1ea73ece 100644 --- a/contrib/postgres_fdw/t/010_subscription.pl +++ b/contrib/postgres_fdw/t/010_subscription.pl @@ -41,7 +41,19 @@ $node_subscriber->safe_psql('postgres', ); $node_subscriber->safe_psql('postgres', - "CREATE USER MAPPING FOR PUBLIC SERVER tap_server"); + "CREATE USER MAPPING FOR PUBLIC SERVER tap_server OPTIONS (use_scram_passthrough 'true')"); + +my ($ret, $stdout, $stderr) = $node_subscriber->psql('postgres', + "CREATE SUBSCRIPTION tap_sub SERVER tap_server PUBLICATION tap_pub WITH (password_required=false)"); +isnt($ret, 0, + 'CREATE SUBSCRIPTION succeeds with use_scram_passthrough'); +like( + $stderr, + qr/ERROR.*SCRAM pass-through authentication is not supported for subscription connections/, + 'CREATE SUBSCRIPTION gives correct connection error'); + +$node_subscriber->safe_psql('postgres', + "ALTER USER MAPPING FOR PUBLIC SERVER tap_server OPTIONS (DROP use_scram_passthrough)"); $node_subscriber->safe_psql('postgres', "CREATE SUBSCRIPTION tap_sub SERVER tap_server PUBLICATION tap_pub WITH (password_required=false)" diff --git a/doc/src/sgml/postgres-fdw.sgml b/doc/src/sgml/postgres-fdw.sgml index b9e1b04463e..8b0669f672d 100644 --- a/doc/src/sgml/postgres-fdw.sgml +++ b/doc/src/sgml/postgres-fdw.sgml @@ -861,6 +861,13 @@ OPTIONS (ADD password_required 'false'); This is a technical requirement of the SCRAM protocol. + + + + The foreign server must not be used for subscription connections + (see ). + + -- 2.43.0