database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-10-23 13:29:09 +03:00
Code Activity

postgres_fdw: reject use_scram_passthrough for subscriptions.

Browse Source 
The subscription is initiated from a logical replication worker, so
SCRAM pass-through won't work.

Partially addresses finding 3 in report from linked discussion.

Reported-by: Noah Misch <noah@leadboat.com>
Discussion: https://postgr.es/m/20260710195902.4f.noahmisch@microsoft.com
Backpatch-through: 19
This commit is contained in:
Jeff Davis
2026-08-03 13:41:17 -07:00
parent 608704adee
commit 8c1723f550
3 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
contrib/postgres_fdw/connection.c
View File

@@ -2479,6 +2479,18 @@ postgres_fdw_connection(PG_FUNCTION_ARGS)
char *appname;
char *sep = "";
/*
* SCRAM pass-through cannot work for subscriptions because the connection
* happens in a worker process.
*/
if (UseScramPassthrough(server, user))
ereport(ERROR,
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
errmsg("SCRAM pass-through authentication is not supported for subscription connections"),
errdetail("The foreign server or user mapping for user \"%s\" has \"use_scram_passthrough\" enabled.",
GetUserNameFromId(userid, false)),
errhint("Store a password in the user mapping instead.")));
construct_connection_params(server, user, &keywords, &values, &appname);
initStringInfo(&str);

16
contrib/postgres_fdw/t/010_subscription.pl
View File

@@ -41,7 +41,21 @@ $node_subscriber->safe_psql('postgres',
);
$node_subscriber->safe_psql('postgres',
"CREATE USER MAPPING FOR PUBLIC SERVER tap_server");
"CREATE USER MAPPING FOR PUBLIC SERVER tap_server OPTIONS (use_scram_passthrough 'true')"
);
my ($ret, $stdout, $stderr) = $node_subscriber->psql('postgres',
"CREATE SUBSCRIPTION tap_sub SERVER tap_server PUBLICATION tap_pub WITH (password_required=false)"
);
isnt($ret, 0, 'CREATE SUBSCRIPTION fails with use_scram_passthrough');
like(
$stderr,
qr/ERROR.*SCRAM pass-through authentication is not supported for subscription connections/,
'CREATE SUBSCRIPTION gives correct connection error');
$node_subscriber->safe_psql('postgres',
"ALTER USER MAPPING FOR PUBLIC SERVER tap_server OPTIONS (DROP use_scram_passthrough)"
);
$node_subscriber->safe_psql('postgres',
"CREATE SUBSCRIPTION tap_sub SERVER tap_server PUBLICATION tap_pub WITH (password_required=false)"

7
doc/src/sgml/postgres-fdw.sgml
View File

@@ -861,6 +861,13 @@ OPTIONS (ADD password_required 'false');
This is a technical requirement of the SCRAM protocol.
</para>
</listitem>
<listitem>
<para>
The foreign server must not be used for subscription connections
(see <xref linkend="postgres-fdw-server-subscription"/>).
</para>
</listitem>
</itemizedlist>
</para>
</listitem>