oauth: Don't log discovery connections by default
Jacob Champion <jchampion@postgresql.org>
Author:
Jacob Champion <jchampion@postgresql.org>
Date: 2026-03-31T18:47:33Z
Releases:
19 (unreleased)
oauth: Don't log discovery connections by default
Currently, when the client sends a parameter discovery request within
OAUTHBEARER, the server logs the attempt with
FATAL: OAuth bearer authentication failed for user
These log entries are difficult to distinguish from true authentication
failures, and by default, libpq sends a discovery request as part of
every OAuth connection, making them annoyingly noisy. Use the new
PG_SASL_EXCHANGE_ABANDONED status to suppress them.
Patch by Zsolt Parragi, with some additional comments added by me.
Author: Zsolt Parragi <zsolt.parragi@percona.com>
Reviewed-by: Andrey Borodin <x4mmm@yandex-team.ru>
Reviewed-by: Chao Li <li.evan.chao@gmail.com>
Discussion: https://postgr.es/m/CAN4CZFPim7hUiyb7daNKQPSZ8CvQRBGkVhbvED7yZi8VktSn4Q%40mail.gmail.com
Files
| Path | Change | +/− |
|---|---|---|
| src/backend/libpq/auth-oauth.c | modified | +30 −15 |
| src/test/modules/oauth_validator/t/001_server.pl | modified | +4 −2 |
Discussion
- Improve OAuth discovery logging 31 messages · 2026-02-11 → 2026-03-31