MIME-Version: 1.0
References: 
 <CAN4CZFPim7hUiyb7daNKQPSZ8CvQRBGkVhbvED7yZi8VktSn4Q@mail.gmail.com>
 <7DB528BA-C7A0-4B23-890C-5332FB35A16E@yesql.se>
 <CAN4CZFNNfhFCQdFWui5HWbQR60eM-cyndZ7YgSv7b5SKxB9C2A@mail.gmail.com>
 <CAOYmi+mDSmh6RNizHRmMAwg4ZP2W=uai3Fr3-wm186NMypf_Pg@mail.gmail.com>
 <CAN4CZFNJftK8NaREYaLi-wqpEz3=crQ=1+3f_XUVji=aOrDSWA@mail.gmail.com>
 <7094F798-8DD1-4974-9A04-10E147B29581@gmail.com>
 <CAOYmi+kjtmRMBdBU3_bGKGDoRSK2AErXbGtHkAjFRapcQNmjhA@mail.gmail.com>
 <CAN4CZFNWBXtF-ML3yzdOvX3QEuUwVo5VrBzyWU3O=y-7SeDstA@mail.gmail.com>
 <15434512-B3FB-4AB3-B6B3-5D85ED0B4BBE@yandex-team.ru>
 <CAN4CZFNscs=hiOkRJYF39r7AD7ef9+MR+O2BQdEtE_2Ajdo5qw@mail.gmail.com>
 <CAOYmi+nVzkoLjzNk_58e0NnUPi9uVXwmurK2QP6CzC2WOpqwbg@mail.gmail.com>
 <CAN4CZFPjiUQbKo2q+ovs--AHkjvaE8OJyncB9xu5b+1gp=HHPQ@mail.gmail.com>
 <CAOYmi+=SR_nJJBh7UXZzK8Zbs21L2RUNkW3d9aPRkQOHj1bBPA@mail.gmail.com>
 <CAN4CZFO7ju7fjjv+qwObP8_V-Tdx463zV8F7u_s6wtg9ANVWVg@mail.gmail.com>
In-Reply-To: 
 <CAN4CZFO7ju7fjjv+qwObP8_V-Tdx463zV8F7u_s6wtg9ANVWVg@mail.gmail.com>
From: Jacob Champion <jacob.champion@enterprisedb.com>
Date: Tue, 10 Mar 2026 14:52:38 -0700
Message-ID: 
 <CAOYmi+kEYA0Tp2son-+Ti1wvSAPov87AVFf4qXATTOHRX1F2gg@mail.gmail.com>
Subject: Re: Improve OAuth discovery logging
To: Zsolt Parragi <zsolt.parragi@percona.com>
Cc: Andrey Borodin <x4mmm@yandex-team.ru>, Chao Li <li.evan.chao@gmail.com>,
	Daniel Gustafsson <daniel@yesql.se>,
 PostgreSQL Hackers <pgsql-hackers@postgresql.org>,
	Michael Paquier <michael@paquier.xyz>, Tom Lane <tgl@sss.pgh.pa.us>
Content-Type: multipart/mixed; boundary="0000000000005d6a0a064cb28a5d"
Archived-At: 
 <https://www.postgresql.org/message-id/CAOYmi%2BkEYA0Tp2son-%2BTi1wvSAPov87AVFf4qXATTOHRX1F2gg%40mail.gmail.com>
Precedence: bulk

--0000000000005d6a0a064cb28a5d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, Mar 5, 2026 at 12:11=E2=80=AFPM Zsolt Parragi <zsolt.parragi@percon=
a.com> wrote:
> Attached v6 with the problematic log expectation removed.

Okay, I was doing some final pre-commit review today and...
unfortunately, using STATUS_EOF like my "TODO" suggested breaks our de
facto SASL profile. The server hasn't completed its side of the
exchange until it sends either
[AuthenticationSASLFinal+]AuthenticationOk or ErrorResponse. Since
STATUS_EOF suppresses not only the log message but the entire
ereport(FATAL), we'll never send that last packet, so a more polite
client can't tell whether the server finished the exchange or just
crashed.

v6 doesn't fail any tests because of a shortcut I took in
PQconnectPoll() in libpq, which skips reading the final message from a
known-doomed OAuth discovery connection. But you can see it if you
apply the attached patch. (It's not a correct patch; it just shows the
problem.)

I'm experimenting with an ereport(FATAL_CLIENT_ONLY) option, in the
same vein as WARNING_CLIENT_ONLY, to try to cover this.

--Jacob

P.S. I would eventually like to record our undocumented SASL profile
in a test suite (he said, staring at pg-pytest)...

--0000000000005d6a0a064cb28a5d
Content-Type: application/octet-stream; name="nocfbot.polite.diff"
Content-Disposition: attachment; filename="nocfbot.polite.diff"
Content-Transfer-Encoding: base64
Content-ID: <f_mml53dnp0>
X-Attachment-Id: f_mml53dnp0

Y29tbWl0IGYyMWMxYjhhZWNjMmE3ZThiYWExYjFiMDA0MDU1ZWFiYjA1NzQwM2IKQXV0aG9yOiBK
YWNvYiBDaGFtcGlvbiA8amFjb2IuY2hhbXBpb25AZW50ZXJwcmlzZWRiLmNvbT4KRGF0ZTogICBU
dWUgTWFyIDEwIDEyOjU4OjA1IDIwMjYKCiAgICBYWFggcG9saXRlIGxpYnBxCgpkaWZmIC0tZ2l0
IGEvc3JjL2ludGVyZmFjZXMvbGlicHEvZmUtYXV0aC1vYXV0aC5jIGIvc3JjL2ludGVyZmFjZXMv
bGlicHEvZmUtYXV0aC1vYXV0aC5jCmluZGV4IDJhZWYzMjdjNjhiLi41NjJjODU5NWMzMiAxMDA2
NDQKLS0tIGEvc3JjL2ludGVyZmFjZXMvbGlicHEvZmUtYXV0aC1vYXV0aC5jCisrKyBiL3NyYy9p
bnRlcmZhY2VzL2xpYnBxL2ZlLWF1dGgtb2F1dGguYwpAQCAtMTQwMCw3ICsxNDAwLDcgQEAgcmVj
b25uZWN0OgogCSAqLwogCWxpYnBxX2FwcGVuZF9jb25uX2Vycm9yKGNvbm4sICJyZXRyeWluZyBj
b25uZWN0aW9uIHdpdGggbmV3IGJlYXJlciB0b2tlbiIpOwogCWNvbm4tPm9hdXRoX3dhbnRfcmV0
cnkgPSB0cnVlOwotCXJldHVybiBTQVNMX0ZBSUxFRDsKKwlyZXR1cm4gU0FTTF9DT01QTEVURTsK
IH0KIAogc3RhdGljIGJvb2wKZGlmZiAtLWdpdCBhL3NyYy9pbnRlcmZhY2VzL2xpYnBxL2ZlLWNv
bm5lY3QuYyBiL3NyYy9pbnRlcmZhY2VzL2xpYnBxL2ZlLWNvbm5lY3QuYwppbmRleCBkYjliNGM4
ZWRiZi4uMTUxZDQwOTZmMzIgMTAwNjQ0Ci0tLSBhL3NyYy9pbnRlcmZhY2VzL2xpYnBxL2ZlLWNv
bm5lY3QuYworKysgYi9zcmMvaW50ZXJmYWNlcy9saWJwcS9mZS1jb25uZWN0LmMKQEAgLTQxMzAs
NiArNDEzMCwxNyBAQCBrZWVwX2dvaW5nOgkJCQkJCS8qIFdlIHdpbGwgY29tZSBiYWNrIHRvIGhl
cmUgdW50aWwgdGhlcmUgaXMKIAkJCQkvKiBIYW5kbGUgZXJyb3JzLiAqLwogCQkJCWlmIChiZXJl
c3AgPT0gUHFNc2dfRXJyb3JSZXNwb25zZSkKIAkJCQl7CisJCQkJCS8qCisJCQkJCSAqIE9BdXRo
IGNvbm5lY3Rpb25zIG1heSBwZXJmb3JtIHR3by1zdGVwIGRpc2NvdmVyeSwgd2hlcmUKKwkJCQkJ
ICogdGhlIGZpcnN0IGNvbm5lY3Rpb24gaXMgYSBkdW1teS4gV2UgZXhwZWN0IGEgZmFpbHVyZQor
CQkJCQkgKiBtZXNzYWdlIHRvIGVuZCB0aGUgU0FTTCBleGNoYW5nZSBmcm9tIHRoZSBzZXJ2ZXIg
c2lkZS4KKwkJCQkJICovCisJCQkJCWlmIChjb25uLT5zYXNsID09ICZwZ19vYXV0aF9tZWNoICYm
IGNvbm4tPm9hdXRoX3dhbnRfcmV0cnkpCisJCQkJCXsKKwkJCQkJCW5lZWRfbmV3X2Nvbm5lY3Rp
b24gPSB0cnVlOworCQkJCQkJZ290byBrZWVwX2dvaW5nOworCQkJCQl9CisKIAkJCQkJaWYgKHBx
R2V0RXJyb3JOb3RpY2UzKGNvbm4sIHRydWUpKQogCQkJCQl7CiAJCQkJCQlsaWJwcV9hcHBlbmRf
Y29ubl9lcnJvcihjb25uLCAicmVjZWl2ZWQgaW52YWxpZCBlcnJvciBtZXNzYWdlIik7CkBAIC00
MjQzLDE5ICs0MjU0LDcgQEAga2VlcF9nb2luZzoJCQkJCQkvKiBXZSB3aWxsIGNvbWUgYmFjayB0
byBoZXJlIHVudGlsIHRoZXJlIGlzCiAJCQkJY29ubi0+aW5TdGFydCA9IGNvbm4tPmluQ3Vyc29y
OwogCiAJCQkJaWYgKHJlcyAhPSBTVEFUVVNfT0spCi0JCQkJewotCQkJCQkvKgotCQkJCQkgKiBP
QXV0aCBjb25uZWN0aW9ucyBtYXkgcGVyZm9ybSB0d28tc3RlcCBkaXNjb3ZlcnksIHdoZXJlCi0J
CQkJCSAqIHRoZSBmaXJzdCBjb25uZWN0aW9uIGlzIGEgZHVtbXkuCi0JCQkJCSAqLwotCQkJCQlp
ZiAoY29ubi0+c2FzbCA9PSAmcGdfb2F1dGhfbWVjaCAmJiBjb25uLT5vYXV0aF93YW50X3JldHJ5
KQotCQkJCQl7Ci0JCQkJCQluZWVkX25ld19jb25uZWN0aW9uID0gdHJ1ZTsKLQkJCQkJCWdvdG8g
a2VlcF9nb2luZzsKLQkJCQkJfQotCiAJCQkJCWdvdG8gZXJyb3JfcmV0dXJuOwotCQkJCX0KIAog
CQkJCS8qCiAJCQkJICogSnVzdCBtYWtlIHN1cmUgdGhhdCBhbnkgZGF0YSBzZW50IGJ5IHBnX2Zl
X3NlbmRhdXRoIGlzCg==
--0000000000005d6a0a064cb28a5d--