postgres_fdw: reject use_scram_passthrough for subscriptions.

The subscription is initiated from a logical replication worker, so
SCRAM pass-through won't work.

Partially addresses finding 3 in report from linked discussion.

Reported-by: Noah Misch <noah@leadboat.com>
Discussion: https://postgr.es/m/20260710195902.4f.noahmisch@microsoft.com
Backpatch-through: 19

diff --git a/contrib/postgres_fdw/connection.c b/contrib/postgres_fdw/connection.c
index aab216959793f2bf7cd03157235b0eec5d22ebea..094eac2f343cf10d756107b39ddee9cc46952fcb 100644 (file)
--- a/contrib/postgres_fdw/connection.c
+++ b/contrib/postgres_fdw/connection.c
@@ -2479,6 +2479,18 @@ postgres_fdw_connection(PG_FUNCTION_ARGS)
        char       *appname;
        char       *sep = "";
 
+       /*
+        * SCRAM pass-through cannot work for subscriptions because the connection
+        * happens in a worker process.
+        */
+       if (UseScramPassthrough(server, user))
+               ereport(ERROR,
+                               (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+                                errmsg("SCRAM pass-through authentication is not supported for subscription connections"),
+                                errdetail("The foreign server or user mapping for user \"%s\" has \"use_scram_passthrough\" enabled.",
+                                                  GetUserNameFromId(userid, false)),
+                                errhint("Store a password in the user mapping instead.")));
+
        construct_connection_params(server, user, &keywords, &values, &appname);
 
        initStringInfo(&str);

diff --git a/contrib/postgres_fdw/t/010_subscription.pl b/contrib/postgres_fdw/t/010_subscription.pl
index c34b3d15b8dfc2a911c520dc27f80cbb7db7dd39..449fa35ce31f53caec540983cf55efcb4cd8be92 100644 (file)
--- a/contrib/postgres_fdw/t/010_subscription.pl
+++ b/contrib/postgres_fdw/t/010_subscription.pl
@@ -41,7 +41,21 @@ $node_subscriber->safe_psql('postgres',
 );
 
 $node_subscriber->safe_psql('postgres',
-       "CREATE USER MAPPING FOR PUBLIC SERVER tap_server");
+       "CREATE USER MAPPING FOR PUBLIC SERVER tap_server OPTIONS (use_scram_passthrough 'true')"
+);
+
+my ($ret, $stdout, $stderr) = $node_subscriber->psql('postgres',
+       "CREATE SUBSCRIPTION tap_sub SERVER tap_server PUBLICATION tap_pub WITH (password_required=false)"
+);
+isnt($ret, 0, 'CREATE SUBSCRIPTION fails with use_scram_passthrough');
+like(
+       $stderr,
+       qr/ERROR.*SCRAM pass-through authentication is not supported for subscription connections/,
+       'CREATE SUBSCRIPTION gives correct connection error');
+
+$node_subscriber->safe_psql('postgres',
+       "ALTER USER MAPPING FOR PUBLIC SERVER tap_server OPTIONS (DROP use_scram_passthrough)"
+);
 
 $node_subscriber->safe_psql('postgres',
        "CREATE SUBSCRIPTION tap_sub SERVER tap_server PUBLICATION tap_pub WITH (password_required=false)"

diff --git a/doc/src/sgml/postgres-fdw.sgml b/doc/src/sgml/postgres-fdw.sgml
index b9e1b04463e27798610d285c8a808ca5bbbd1209..8b0669f672d34251db5e4131e97633d931dc79f1 100644 (file)
--- a/doc/src/sgml/postgres-fdw.sgml
+++ b/doc/src/sgml/postgres-fdw.sgml
@@ -861,6 +861,13 @@ OPTIONS (ADD password_required 'false');
            This is a technical requirement of the SCRAM protocol.
           </para>
          </listitem>
+
+         <listitem>
+          <para>
+           The foreign server must not be used for subscription connections
+           (see <xref linkend="postgres-fdw-server-subscription"/>).
+          </para>
+         </listitem>
         </itemizedlist>
        </para>
       </listitem>