oauth: Recheck oauth_validator_libraries during authentication The validator allowlist is only enforced while parsing pg_hba.conf. If changing oauth_validator_libraries makes an existing oauth line invalid, the HBA reload fails and the old lines stay in use, so a removed validator keeps authenticating users. In particular, when setting the list to the empty string, the server doesn't refuse an OAuth connection, as documented.
Backpatch down to v18 where OAuth was introduced. Author: Zsolt Parragi <[email protected]> Reviewed-by: Daniel Gustafsson <[email protected]> Reviewed-by: shihao zhong <[email protected]> Discussion: https://postgr.es/m/CAN4CZFNbWXwC=s4t9xu1kitlsqvte-ewpvtfcjixwchbxrt...@mail.gmail.com Backpatch-through: 18 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/c38de3ae6098ccf1904109f2e550eb4777f66024 Modified Files -------------- src/backend/libpq/auth-oauth.c | 14 ++++++++++++++ src/test/modules/oauth_validator/t/001_server.pl | 18 ++++++++++++++++++ 2 files changed, 32 insertions(+)
