From ce46e5cacc67b0da0038a698e8ff3cdb5ab4e71e Mon Sep 17 00:00:00 2001 From: shihao zhong Date: Tue, 3 Nov 2026 21:27:52 -0500 Subject: [PATCH] Reject the login when the validator is no longer allowed check_oauth_validator() only logs at COMMERROR, so its return value has to be checked. Otherwise the removed validator is still loaded and the login succeeds. Raise the usual OAuth failure message when the check fails, and make the test expect it. The old test passed without the fix because the client fails at discovery either way. --- src/backend/libpq/auth-oauth.c | 6 +++++- src/test/modules/oauth_validator/t/001_server.pl | 3 ++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/src/backend/libpq/auth-oauth.c b/src/backend/libpq/auth-oauth.c index 8715e5086db..2c9854fbdd7 100644 --- a/src/backend/libpq/auth-oauth.c +++ b/src/backend/libpq/auth-oauth.c @@ -133,7 +133,11 @@ oauth_init(Port *port, const char *selected_mech, const char *shadow_pass) * fail, we're still using the old HBA lines, and their validator may no * longer be permitted. Check again before loading it. */ - check_oauth_validator(port->hba, COMMERROR, &err_msg); + if (!check_oauth_validator(port->hba, COMMERROR, &err_msg)) + ereport(FATAL, + errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION), + errmsg("OAuth bearer authentication failed for user \"%s\"", + port->user_name)); load_validator_library(port->hba->oauth_validator); diff --git a/src/test/modules/oauth_validator/t/001_server.pl b/src/test/modules/oauth_validator/t/001_server.pl index 339cf7bd18c..b9333e5bca5 100644 --- a/src/test/modules/oauth_validator/t/001_server.pl +++ b/src/test/modules/oauth_validator/t/001_server.pl @@ -148,7 +148,8 @@ $bgconn->query_safe('SELECT 1'); $node->connect_fails( "user=test dbname=postgres oauth_issuer=$issuer oauth_client_id=f02c6361-0635", "validator removed from oauth_validator_libraries is not used", - expected_stderr => qr/could not fetch OpenID discovery document/, + expected_stderr => + qr/OAuth bearer authentication failed for user "test"/, log_like => [ qr/parameter "oauth_validator_libraries" must be set for authentication method "oauth"/ ]); -- 2.37.1 (Apple Git-137.1)