database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-05-28 05:21:27 +03:00
Code

oauth: Disallow OAuth connections via postgres_fdw/dblink

Browse Source 
A subsequent commit will reclassify oauth_client_secret from dispchar=""
to dispchar="*", so that UIs will treat it like a secret. For our FDWs,
this change will move that option from SERVER to USER MAPPING, which we
need to avoid.

But upon further discussion, we don't really want our FDWs to use our
builtin Device Authorization flow at all, for several reasons:

- the URL and code would be printed to the server logs, not sent over
  the client connection
- tokens are not cached/refreshed, so every single connection has to be
  manually authorized by a user with a browser
- oauth_client_secret needs to belong to the foreign server, but options
  on SERVER are publicly accessible
- all non-superusers would need password_required=false, which is
  dangerous

Future OAuth work can use FDWs as a motivating use case. But for now,
disallow all oauth_* connection options for these two extensions.

Reviewed-by: Noah Misch <noah@leadboat.com>
Discussion: https://postgr.es/m/20250415191435.55.nmisch%40google.com
This commit is contained in:
Jacob Champion 2025-04-29 13:08:24 -07:00
parent 45363fca63
commit d2e7d2a09d
6 changed files with 52 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
contrib/dblink/dblink.c
View File

@ -3094,6 +3094,13 @@ is_valid_dblink_option(const PQconninfoOption *options, const char *option,
if (strcmp(opt->keyword, "client_encoding") == 0)
return false;
/*
* Disallow OAuth options for now, since the builtin flow communicates on
* stderr by default and can't cache tokens yet.
*/
if (strncmp(opt->keyword, "oauth_", strlen("oauth_")) == 0)
return false;
/*
* If the option is "user" or marked secure, it should be specified only
* in USER MAPPING. Others should be specified only in SERVER.

11
contrib/dblink/expected/dblink.out
View File

@ -898,6 +898,17 @@ CREATE USER MAPPING FOR public SERVER fdtest
OPTIONS (server 'localhost'); -- fail, can't specify server here
ERROR: invalid option "server"
CREATE USER MAPPING FOR public SERVER fdtest OPTIONS (user :'USER');
-- OAuth options are not allowed in either context
ALTER SERVER fdtest OPTIONS (ADD oauth_issuer 'https://example.com');
ERROR: invalid option "oauth_issuer"
ALTER SERVER fdtest OPTIONS (ADD oauth_client_id 'myID');
ERROR: invalid option "oauth_client_id"
ALTER USER MAPPING FOR public SERVER fdtest
OPTIONS (ADD oauth_issuer 'https://example.com');
ERROR: invalid option "oauth_issuer"
ALTER USER MAPPING FOR public SERVER fdtest
OPTIONS (ADD oauth_client_id 'myID');
ERROR: invalid option "oauth_client_id"
GRANT USAGE ON FOREIGN SERVER fdtest TO regress_dblink_user;
GRANT EXECUTE ON FUNCTION dblink_connect_u(text, text) TO regress_dblink_user;
SET SESSION AUTHORIZATION regress_dblink_user;

8
contrib/dblink/sql/dblink.sql
View File

@ -469,6 +469,14 @@ CREATE USER MAPPING FOR public SERVER fdtest
OPTIONS (server 'localhost'); -- fail, can't specify server here
CREATE USER MAPPING FOR public SERVER fdtest OPTIONS (user :'USER');
-- OAuth options are not allowed in either context
ALTER SERVER fdtest OPTIONS (ADD oauth_issuer 'https://example.com');
ALTER SERVER fdtest OPTIONS (ADD oauth_client_id 'myID');
ALTER USER MAPPING FOR public SERVER fdtest
OPTIONS (ADD oauth_issuer 'https://example.com');
ALTER USER MAPPING FOR public SERVER fdtest
OPTIONS (ADD oauth_client_id 'myID');
GRANT USAGE ON FOREIGN SERVER fdtest TO regress_dblink_user;
GRANT EXECUTE ON FUNCTION dblink_connect_u(text, text) TO regress_dblink_user;

11
contrib/postgres_fdw/expected/postgres_fdw.out
View File

@ -196,6 +196,17 @@ ALTER USER MAPPING FOR public SERVER testserver1
-- permitted to check validation.
ALTER USER MAPPING FOR public SERVER testserver1
OPTIONS (ADD sslkey 'value', ADD sslcert 'value');
-- OAuth options are not allowed in either context
ALTER SERVER testserver1 OPTIONS (ADD oauth_issuer 'https://example.com');
ERROR: invalid option "oauth_issuer"
ALTER SERVER testserver1 OPTIONS (ADD oauth_client_id 'myID');
ERROR: invalid option "oauth_client_id"
ALTER USER MAPPING FOR public SERVER testserver1
OPTIONS (ADD oauth_issuer 'https://example.com');
ERROR: invalid option "oauth_issuer"
ALTER USER MAPPING FOR public SERVER testserver1
OPTIONS (ADD oauth_client_id 'myID');
ERROR: invalid option "oauth_client_id"
ALTER FOREIGN TABLE ft1 OPTIONS (schema_name 'S 1', table_name 'T 1');
ALTER FOREIGN TABLE ft2 OPTIONS (schema_name 'S 1', table_name 'T 1');
ALTER FOREIGN TABLE ft1 ALTER COLUMN c1 OPTIONS (column_name 'C 1');

7
contrib/postgres_fdw/option.c
View File

@ -348,6 +348,13 @@ InitPgFdwOptions(void)
strcmp(lopt->keyword, "client_encoding") == 0)
continue;
/*
* Disallow OAuth options for now, since the builtin flow communicates
* on stderr by default and can't cache tokens yet.
*/
if (strncmp(lopt->keyword, "oauth_", strlen("oauth_")) == 0)
continue;
/* We don't have to copy keyword string, as described above. */
popt->keyword = lopt->keyword;

8
contrib/postgres_fdw/sql/postgres_fdw.sql
View File

@ -213,6 +213,14 @@ ALTER USER MAPPING FOR public SERVER testserver1
ALTER USER MAPPING FOR public SERVER testserver1
OPTIONS (ADD sslkey 'value', ADD sslcert 'value');
-- OAuth options are not allowed in either context
ALTER SERVER testserver1 OPTIONS (ADD oauth_issuer 'https://example.com');
ALTER SERVER testserver1 OPTIONS (ADD oauth_client_id 'myID');
ALTER USER MAPPING FOR public SERVER testserver1
OPTIONS (ADD oauth_issuer 'https://example.com');
ALTER USER MAPPING FOR public SERVER testserver1
OPTIONS (ADD oauth_client_id 'myID');
ALTER FOREIGN TABLE ft1 OPTIONS (schema_name 'S 1', table_name 'T 1');
ALTER FOREIGN TABLE ft2 OPTIONS (schema_name 'S 1', table_name 'T 1');
ALTER FOREIGN TABLE ft1 ALTER COLUMN c1 OPTIONS (column_name 'C 1');