From: Jacob Champion <jchampion@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: oauth: Don't log discovery connections by default
Date: Tue, 31 Mar 2026 18:49:28 +0000
Message-ID: <E1w7e9X-002LfC-2Y@gemulon.postgresql.org> (raw)
oauth: Don't log discovery connections by default
Currently, when the client sends a parameter discovery request within
OAUTHBEARER, the server logs the attempt with
FATAL: OAuth bearer authentication failed for user
These log entries are difficult to distinguish from true authentication
failures, and by default, libpq sends a discovery request as part of
every OAuth connection, making them annoyingly noisy. Use the new
PG_SASL_EXCHANGE_ABANDONED status to suppress them.
Patch by Zsolt Parragi, with some additional comments added by me.
Author: Zsolt Parragi <zsolt.parragi@percona.com>
Reviewed-by: Andrey Borodin <x4mmm@yandex-team.ru>
Reviewed-by: Chao Li <li.evan.chao@gmail.com>
Discussion: https://postgr.es/m/CAN4CZFPim7hUiyb7daNKQPSZ8CvQRBGkVhbvED7yZi8VktSn4Q%40mail.gmail.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/e020a897efeaed52cd3f5fef7f933cb5dc6cbfaf
Modified Files
--------------
src/backend/libpq/auth-oauth.c | 45 ++++++++++++++++--------
src/test/modules/oauth_validator/t/001_server.pl | 6 ++--
2 files changed, 34 insertions(+), 17 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: jchampion@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: oauth: Don't log discovery connections by default
In-Reply-To: <E1w7e9X-002LfC-2Y@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox