oauth: Recheck oauth_validator_libraries during authentication The validator allowlist is only enforced while parsing pg_hba.conf. If changing oauth_validator_libraries makes an existing oauth line invalid, the HBA reload fails and the old lines stay in use, so a removed validator keeps authenticating users. In particular, when setting the list to the empty string, the server doesn't refuse an OAuth connection, as documented.
Backpatch down to v18 where OAuth was introduced. Author: Zsolt Parragi <[email protected]> Reviewed-by: Daniel Gustafsson <[email protected]> Reviewed-by: shihao zhong <[email protected]> Discussion: https://postgr.es/m/CAN4CZFNbWXwC=s4t9xu1kitlsqvte-ewpvtfcjixwchbxrt...@mail.gmail.com Backpatch-through: 18 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/8e54a414570010afed0b8b1ed10882afba380166 Modified Files -------------- src/backend/libpq/auth-oauth.c | 14 ++++++++++++++ src/test/modules/oauth_validator/t/001_server.pl | 16 ++++++++++++++++ 2 files changed, 30 insertions(+)
