MIME-Version: 1.0
References: <83C44AB4-24B0-437F-B139-B5CBC5821BB1@yesql.se>
 <CAOYmi+=zgJinCoqdQ70fvKmvyrLekd9-supkuj57Poa1FmX8bw@mail.gmail.com>
 <2A1511A0-C04B-47E4-B1C3-54C2A1C765B8@yesql.se> <CAOYmi+=1_AqPL0Y7qdqg1ER0-bBjCUKUZfrLcgob5bHjzSsvbA@mail.gmail.com>
 <CAOYmi+nP8AM9xm+xUW5kDz7XDF7MKBjuDnQ4LjMEm07tpwDgrg@mail.gmail.com>
 <AACF415F-894A-434F-9FE2-272ED8FA4981@yesql.se> <13F329B6-86BC-40A5-96F4-102784A0357A@yesql.se>
 <CAOYmi+nZUivtO3Ed4X3tBh3sLmMQTe+ir7utyc1Gv5L6ZDU5cA@mail.gmail.com>
 <p4bd7mn6dxr2zdak74abocyltpfdxif4pxqzixqpxpetjwt34h@qc6jgfmoddvq>
 <CAOYmi+nePFefTKmeRtajfVhunbXFq64etBr7VwbhxzDBQL-BBw@mail.gmail.com>
 <uqzksikuuprgcu4mrpqdu65s7loh52pghdaq5rkzdruhgy4wse@4ojpvnsfumpc>
 <CAOYmi+=Pyf9EuR7dRn46ymV-P9fhUft3qH8mqdS-m9ZksmooEg@mail.gmail.com>
 <CAOYmi+mhqahb65y1zXtv60T9=mDYTaepV9b-wq-GHey00zuGOg@mail.gmail.com>
 <CA+hUKGJ+WyJ26QGvO_nkgvbxgw+03U4EQ4Hxw+QBft6Np+XW7w@mail.gmail.com>
 <CAOYmi+mf+hw7x+E3XkRypEGy=yR3n6zowjjXeXaSK20WxX3UGw@mail.gmail.com>
 <CAOYmi+kr-Eh7utEDZBFq8Mc9byLLRF3ZNc0TaHt78SKwB4T5KA@mail.gmail.com>
 <CA+hUKGL3yYmKmNHw1wnpuhCbqaiDw1DDUhghEDrh6y97Ygzw9Q@mail.gmail.com>
 <CAOYmi+kOyST1DoF1WOMQvf75L56LiLHZR2+3qTJ+QCg2KC8raQ@mail.gmail.com> <CA+hUKGL59uY=UpCHEmTL6dpzuWJBVf1Kc4bQADYDEWG9ZDCffA@mail.gmail.com>
In-Reply-To: <CA+hUKGL59uY=UpCHEmTL6dpzuWJBVf1Kc4bQADYDEWG9ZDCffA@mail.gmail.com>
From: Jacob Champion <jacob.champion@enterprisedb.com>
Date: Tue, 4 Mar 2025 09:08:00 -0800
Message-ID: <CAOYmi+k6HUMK4XQAfnxsmgs1oPOKnchyj2O2a+R7H9jOTU4LPQ@mail.gmail.com>
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
To: Thomas Munro <thomas.munro@gmail.com>
Cc: Andres Freund <andres@anarazel.de>, Daniel Gustafsson <daniel@yesql.se>, 
	Peter Eisentraut <peter@eisentraut.org>, Antonin Houska <ah@cybertec.at>, 
	PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CAOYmi%2Bk6HUMK4XQAfnxsmgs1oPOKnchyj2O2a%2BR7H9jOTU4LPQ%40mail.gmail.com>
Precedence: bulk

On Mon, Mar 3, 2025 at 4:07=E2=80=AFPM Jacob Champion
<jacob.champion@enterprisedb.com> wrote:
> I wonder if
> my test server doesn't handle dual-stack setups correctly.

Spoilers: it's this.

> I'll see if
> I can get ktruss working on either side.

ktruss shows absolutely no syscall activity on the authorization
server during the failing test, because Curl's talking to something
else. sockstat confirms that I completely forgot to listen on IPv6 in
the test server. Dual stack sockets only work from the IPv6
direction...

There must be some law of conservation of weirdness, where the
strangest failure modes have the most boring explanations. I'll work
on a fix.

On Mon, Mar 3, 2025 at 8:11=E2=80=AFPM Thomas Munro <thomas.munro@gmail.com=
> wrote:
> I think that is telling us that a non-blocking socket can be in a
> state that is not yet connected enough even to tell you its local
> address?  That is, connect() returns without having allocated a local
> address, and does that part asynchronously too?  I don't know what to
> think about that yet...

That is also really good to know, though. So that EINVAL message
might, in the end, be completely unrelated to the bug? (Curl doesn't
worry about the error, looks like, just prints it to the debug
stream.)

Thanks!
--Jacob