10000 oauth: Disallow OAuth connections via postgres_fdw/dblink · postgres/postgres@d2e7d2a · GitHub
[go: up one dir, main page]
Skip to content

Commit d2e7d2a

Browse files
jchampiojchampio
committed
oauth: Disallow OAuth connections via postgres_fdw/dblink
A subsequent commit will reclassify oauth_client_secret from dispchar="" to dispchar="*", so that UIs will treat it like a secret. For our FDWs, this change will move that option from SERVER to USER MAPPING, which we need to avoid. But upon further discussion, we don't really want our FDWs to use our builtin Device Authorization flow at all, for several reasons: - the URL and code would be printed to the server logs, not sent over the client connection - tokens are not cached/refreshed, so every single connection has to be manually authorized by a user with a browser - oauth_client_secret needs to belong to the foreign server, but options on SERVER are publicly accessible - all non-superusers would need password_required=false, which is dangerous Future OAuth work can use FDWs as a motivating use case. But for now, disallow all oauth_* connection options for these two extensions. Reviewed-by: Noah Misch <noah@leadboat.com> Discussion: https://postgr.es/m/20250415191435.55.nmisch%40google.com
1 parent 45363fc commit d2e7d2a

File tree

6 files changed

+52
-0
lines changed

6 files changed

+52
-0
lines changed

‎contrib/dblink/dblink.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3094,6 +3094,13 @@ is_valid_dblink_option(const PQconninfoOption *options, const char *option,
30943094
if (strcmp(opt->keyword, "client_encoding") == 0)
30953095
return false;
30963096

3097+
/*
3098+
* Disallow OAuth options for now, since the builtin flow communicates on
3099+
* stderr by default and can't cache tokens yet.
3100+
*/
3101+
if (strncmp(opt->keyword, "oauth_", strlen("oauth_")) == 0)
3102+
return false;
3103+
30973104
/*
30983105
* If the option is "user" or marked secure, it should be specified only
30993106
* in USER MAPPING. Others should be specified only in SERVER.

‎contrib/dblink/expected/dblink.out

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -898,6 +898,17 @@ CREATE USER MAPPING FOR public SERVER fdtest
898898
OPTIONS (server 'localhost'); -- fail, can't specify server here
899899
ERROR: invalid option "server"
900900
CREATE USER MAPPING FOR public SERVER fdtest OPTIONS (user :'USER');
901+
-- OAuth options are not allowed in either context
902+
ALTER SERVER fdtest OPTIONS (ADD oauth_issuer 'https://example.com');
903+
ERROR: invalid option "oauth_issuer"
904+
ALTER SERVER fdtest OPTIONS (ADD oauth_client_id 'myID');
905+
ERROR: invalid option "oauth_client_id"
906+
ALTER USER MAPPING FOR public SERVER fdtest
907+
OPTIONS (ADD oauth_issuer 'https://example.com');
908+
ERROR: invalid option "oauth_issuer"
909+
ALTER USER MAPPING FOR public SERVER fdtest
910+
OPTIONS (ADD oauth_client_id 'myID');
911+
ERROR: invalid option "oauth_client_id"
901912
GRANT USAGE ON FOREIGN SERVER fdtest TO regress_dblink_user;
902913
GRANT EXECUTE ON FUNCTION dblink_connect_u(text, text) TO regress_dblink_user;
903914
SET SESSION AUTHORIZATION regress_dblink_user;

‎contrib/dblink/sql/dblink.sql

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -469,6 +469,14 @@ CREATE USER MAPPING FOR public SERVER fdtest
469469
OPTIONS (server 'localhost'); -- fail, can't specify server here
470470
CREATE USER MAPPING FOR public SERVER fdtest OPTIONS (user :'USER');
471471

472+
-- OAuth options are not allowed in either context
473+
ALTER SERVER fdtest OPTIONS (ADD oauth_issuer 'https://example.com');
474+
ALTER SERVER fdtest OPTIONS (ADD oauth_client_id 'myID');
475+
ALTER USER MAPPING FOR public SERVER fdtest
476+
OPTIONS (ADD oauth_issuer 'https://example.com');
477+
ALTER USER MAPPING FOR public SERVER fdtest
478+
OPTIONS (ADD oauth_client_id 'myID');
479+
472480
GRANT USAGE ON FOREIGN SERVER fdtest TO regress_dblink_user;
473481
GRANT EXECUTE ON FUNCTION dblink_connect_u(text, text) TO regress_dblink_user;
474482

‎contrib/postgres_fdw/expected/postgres_fdw.out

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,17 @@ ALTER USER MAPPING FOR public SERVER testserver1
196196
-- permitted to check validation.
197197
ALTER USER MAPPING FOR public SERVER testserver1
198198
OPTIONS (ADD sslkey 'value', ADD sslcert 'value');
199+
-- OAuth options are not allowed in either context
200+
ALTER SERVER testserver1 OPTIONS (ADD oauth_issuer 'https://example.com');
201+
ERROR: invalid option "oauth_issuer"
202+
ALTER SERVER testserver1 OPTIONS (ADD oauth_client_id 'myID');
203+
ERROR: invalid option "oauth_client_id"
204+
ALTER USER MAPPING FOR public SERVER testserver1
205+
OPTIONS (ADD oauth_issuer 'https://example.com');
206+
ERROR: invalid option "oauth_issuer"
207+
ALTER USER MAPPING FOR public SERVER testserver1
208+
OPTIONS (ADD oauth_client_id 'myID');
209+
ERROR: invalid option "oauth_client_id"
199210
ALTER FOREIGN TABLE ft1 OPTIONS (schema_name 'S 1', table_name 'T 1');
200211
ALTER FOREIGN TABLE ft2 OPTIONS (schema_name 'S 1', table_name 'T 1');
201212
ALTER FOREIGN TABLE ft1 ALTER COLUMN c1 OPTIONS (column_name 'C 1');

‎contrib/postgres_fdw/option.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -348,6 +348,13 @@ InitPgFdwOptions(void)
348348
strcmp(lopt->keyword, "client_encoding") == 0)
349349
continue;
350350

351+
/*
352+
* Disallow OAuth options for now, since the builtin flow communicates
353+
* on stderr by default and can't cache tokens yet.
354+
*/
355+
if (strncmp(lopt->keyword, "oauth_", strlen("oauth_")) == 0)
356+
continue;
357+
351358
/* We don't have to copy keyword string, as described above. */
352359
popt->keyword = lopt->keyword;
353360

‎contrib/postgres_fdw/sql/postgres_fdw.sql

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,14 @@ ALTER USER MAPPING FOR public SERVER testserver1
213213
ALTER USER MAPPING FOR public SERVER testserver1
214214
OPTIONS (ADD sslkey 'value', ADD sslcert 'value');
215215

216+
-- OAuth options are not allowed in either context
217+
ALTER SERVER testserver1 OPTIONS (ADD oauth_issuer 'https://example.com');
218+
ALTER SERVER testserver1 OPTIONS (ADD oauth_client_id 'myID');
219+
ALTER USER MAPPING FOR public SERVER testserver1
220+
OPTIONS (ADD oauth_issuer 'https://example.com');
221+
ALTER USER MAPPING FOR public SERVER testserver1
222+
OPTIONS (ADD oauth_client_id 'myID');
223+
216224
ALTER FOREIGN TABLE ft1 OPTIONS (schema_name 'S 1', table_name 'T 1');
217225
ALTER FOREIGN TABLE ft2 OPTIONS (schema_name 'S 1', table_name 'T 1');
218226
ALTER FOREIGN TABLE ft1 ALTER COLUMN c1 OPTIONS (column_name 'C 1');

0 commit comments

Comments
 (0)
0