From: Jacob Champion <jchampion@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: oauth: Disallow OAuth connections via postgres_fdw/dblink
Date: Tue, 29 Apr 2025 20:23:24 +0000
Message-ID: <E1u9rUC-000D6N-0R@gemulon.postgresql.org> (raw)
oauth: Disallow OAuth connections via postgres_fdw/dblink
A subsequent commit will reclassify oauth_client_secret from dispchar=""
to dispchar="*", so that UIs will treat it like a secret. For our FDWs,
this change will move that option from SERVER to USER MAPPING, which we
need to avoid.
But upon further discussion, we don't really want our FDWs to use our
builtin Device Authorization flow at all, for several reasons:
- the URL and code would be printed to the server logs, not sent over
the client connection
- tokens are not cached/refreshed, so every single connection has to be
manually authorized by a user with a browser
- oauth_client_secret needs to belong to the foreign server, but options
on SERVER are publicly accessible
- all non-superusers would need password_required=false, which is
dangerous
Future OAuth work can use FDWs as a motivating use case. But for now,
disallow all oauth_* connection options for these two extensions.
Reviewed-by: Noah Misch <noah@leadboat.com>
Discussion: https://postgr.es/m/20250415191435.55.nmisch%40google.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/d2e7d2a09d7d17656418f8c859074db690af19ec
Modified Files
--------------
contrib/dblink/dblink.c | 7 +++++++
contrib/dblink/expected/dblink.out | 11 +++++++++++
contrib/dblink/sql/dblink.sql | 8 ++++++++
contrib/postgres_fdw/expected/postgres_fdw.out | 11 +++++++++++
contrib/postgres_fdw/option.c | 7 +++++++
contrib/postgres_fdw/sql/postgres_fdw.sql | 8 ++++++++
6 files changed, 52 insertions(+)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: jchampion@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: oauth: Disallow OAuth connections via postgres_fdw/dblink
In-Reply-To: <E1u9rUC-000D6N-0R@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox