oauth: Recheck oauth_validator_libraries during authentication The validator allowlist is only enforced while parsing pg_hba.conf. If changing oauth_validator_libraries makes an existing oauth line invalid, the HBA reload fails and the old lines stay in use, so a removed validator keeps authenticating users. In particular, when setting the list to the empty string, the server doesn't refuse an OAuth connection, as documented.
Backpatch down to v18 where OAuth was introduced. Author: Zsolt Parragi <[email protected]> Reviewed-by: Daniel Gustafsson <[email protected]> Reviewed-by: shihao zhong <[email protected]> Discussion: https://postgr.es/m/CAN4CZFNbWXwC=s4t9xu1kitlsqvte-ewpvtfcjixwchbxrt...@mail.gmail.com Backpatch-through: 18 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/e352ac8c5c90ed6ce792f044c22145578542a330 Modified Files -------------- src/backend/libpq/auth-oauth.c | 14 ++++++++++++++ src/test/modules/oauth_validator/t/001_server.pl | 18 ++++++++++++++++++ 2 files changed, 32 insertions(+)
