MIME-Version: 1.0
References: <202601241015.y5uvxd7oxnfs@alvherre.pgsql>
 <CAOYmi+kLmjJmtmkKs1mWcmNFsgQWsY8ajRhctsrmeVy-y6OKFw@mail.gmail.com>
In-Reply-To: 
 <CAOYmi+kLmjJmtmkKs1mWcmNFsgQWsY8ajRhctsrmeVy-y6OKFw@mail.gmail.com>
From: Jacob Champion <jacob.champion@enterprisedb.com>
Date: Wed, 18 Mar 2026 09:47:14 -0700
Message-ID: 
 <CAOYmi+naxE5os6dSPpVp-=ip=xv_dfmtypOOjzEfreA2KgVPTA@mail.gmail.com>
Subject: Re: unclear OAuth error message
To: =?UTF-8?Q?=C3=81lvaro_Herrera?= <alvherre@kurilemu.de>
Cc: Pg Hackers <pgsql-hackers@lists.postgresql.org>,
	Zsolt Parragi <zsolt.parragi@percona.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: 
 <https://www.postgresql.org/message-id/CAOYmi%2BnaxE5os6dSPpVp-%3Dip%3Dxv_dfmtypOOjzEfreA2KgVPTA%40mail.gmail.com>
Precedence: bulk

On Mon, Jan 26, 2026 at 2:17=E2=80=AFPM Jacob Champion
<jacob.champion@enterprisedb.com> wrote:
> For that code path I suspect we could get rid of the entire message,
> because of what you mentioned later: auth_failed() is already going to
> give us that. The validator can log what's important if needed, or
> not. We could add some DEBUGs, maybe, so that you can still figure out
> what's going on if a validator fails silently?

I only just remembered that this is exactly what logdetail is designed
to do. It's passed in from CheckSASLAuth, but OAuth doesn't make use
of it. (My original patchset carried a TODO for this for a long time,
but I lost it at some point...)

I have a parallel patchset that also needs logdetail, so this fix can
piggyback on some of that work.

--Jacob