pgpool2.git / summary / log / commit / refs

commit    f247bdc5d892064a181d265ef62deeb85d88bc46
Author:   Muhammad Usama <m.usama@gmail.com>
Date:     Thu Nov 15 20:48:31 2018 +0000

    Fix broken authentication for Pgpool's internal connections
    
    The issue is caused by a  mistake in "SCRAM and Certificate authentication
    support" commit.
    The problem is while authenticating against backend in connection_do_auth(), it
    returns to caller as soon as backend returns auth ok response.  So
    authentication itself established fine. However connection_do_auth()
    does not proceed until it receives "Ready for query", it is required
    according to the frontend/backend protocol.
    The fix is to keep processing the data after receiving auth_ok response
    until we get ready for query.
    
    Patch provided by Tatsuo Ishii <ishii@sraoss.co.jp> and a tiny modification
    made by me


 src/auth/pool_auth.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/auth/pool_auth.c b/src/auth/pool_auth.c
index 99758222c..d53a5354b 100644
--- a/src/auth/pool_auth.c
+++ b/src/auth/pool_auth.c
@@ -153,7 +153,6 @@ connection_do_auth(POOL_CONNECTION_POOL_SLOT * cp, char *password)
 					 errdetail("backend replied with invalid kind")));
 
 		cp->con->auth_kind = AUTH_REQ_OK;
-		return;
 	}
 	else if (auth_kind == AUTH_REQ_CRYPT)	/* crypt password? */
 	{
@@ -177,7 +176,6 @@ connection_do_auth(POOL_CONNECTION_POOL_SLOT * cp, char *password)
 					 errdetail("backend replied with invalid kind")));
 
 		cp->con->auth_kind = AUTH_REQ_OK;
-		return;
 	}
 	else if (auth_kind == AUTH_REQ_MD5) /* md5 password? */
 	{
@@ -204,7 +202,6 @@ connection_do_auth(POOL_CONNECTION_POOL_SLOT * cp, char *password)
 					 errdetail("backend replied with invalid kind")));
 
 		cp->con->auth_kind = AUTH_REQ_OK;
-		return;
 	}
 	else if (auth_kind == AUTH_REQ_SASL)
 	{
@@ -216,6 +213,7 @@ connection_do_auth(POOL_CONNECTION_POOL_SLOT * cp, char *password)
 		}
 		ereport(DEBUG1,
 				(errmsg("SCRAM authentication successful for user:%s", cp->sp->user)));
+		cp->con->auth_kind = AUTH_REQ_OK;
 	}
 	else
 	{


[parent: 4303ceeff86c]