]> git.ipfire.org Git - thirdparty/postgresql.git/commit
oauth: Let validators provide failure DETAILs
authorJacob Champion <jchampion@postgresql.org>
Fri, 3 Apr 2026 23:05:33 +0000 (16:05 -0700)
committerJacob Champion <jchampion@postgresql.org>
Fri, 3 Apr 2026 23:05:33 +0000 (16:05 -0700)
commitd438a36591c58f60e0748b341855ec5519e1e3b4
tree4080cd765a2714b1057a7c6f415e01fab745d890
parent0036232ba8fb282979cff16c8751a361cb85fe76
oauth: Let validators provide failure DETAILs

At the moment, the only way for a validator module to report error
details on failure is to log them separately before returning from
validate_cb. Independently of that problem, the ereport() calls that we
make during validation failure partially duplicate some of the work of
auth_failed().

The end result is overly verbose and confusing for readers of the logs:

    [768233] LOG:  [my_validator] bad signature in bearer token
    [768233] LOG:  OAuth bearer authentication failed for user "jacob"
    [768233] DETAIL:  Validator failed to authorize the provided token.
    [768233] FATAL:  OAuth bearer authentication failed for user "jacob"
    [768233] DETAIL:  Connection matched file ".../pg_hba.conf" line ...

Solve both problems by making use of the existing logdetail pointer
that's provided by ClientAuthentication. Validator modules may set
ValidatorModuleResult->error_detail to override our default generic
message.

The end result looks something like

    [242284] FATAL:  OAuth bearer authentication failed for user "jacob"
    [242284] DETAIL:  [my_validator] bad signature in bearer token
        Connection matched file ".../pg_hba.conf" line ...

Reported-by: Álvaro Herrera <alvherre@kurilemu.de>
Reported-by: Zsolt Parragi <zsolt.parragi@percona.com>
Reviewed-by: Chao Li <li.evan.chao@gmail.com>
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Zsolt Parragi <zsolt.parragi@percona.com>
Discussion: https://postgr.es/m/202601241015.y5uvxd7oxnfs%40alvherre.pgsql
doc/src/sgml/oauth-validators.sgml
src/backend/libpq/auth-oauth.c
src/backend/libpq/auth.c
src/include/libpq/oauth.h
src/test/modules/oauth_validator/t/001_server.pl
src/test/modules/oauth_validator/validator.c