Re: [PoC] Federated Authn/z with OAUTHBEARER - Mailing list pgsql-hackers

From Jacob Champion
Subject Re: [PoC] Federated Authn/z with OAUTHBEARER
Date
Msg-id CAOYmi+k6HUMK4XQAfnxsmgs1oPOKnchyj2O2a+R7H9jOTU4LPQ@mail.gmail.com
Whole thread Raw
In response to Re: [PoC] Federated Authn/z with OAUTHBEARER  (Thomas Munro <thomas.munro@gmail.com>)
Responses Re: [PoC] Federated Authn/z with OAUTHBEARER
List pgsql-hackers
On Mon, Mar 3, 2025 at 4:07 PM Jacob Champion
<jacob.champion@enterprisedb.com> wrote:
> I wonder if
> my test server doesn't handle dual-stack setups correctly.

Spoilers: it's this.

> I'll see if
> I can get ktruss working on either side.

ktruss shows absolutely no syscall activity on the authorization
server during the failing test, because Curl's talking to something
else. sockstat confirms that I completely forgot to listen on IPv6 in
the test server. Dual stack sockets only work from the IPv6
direction...

There must be some law of conservation of weirdness, where the
strangest failure modes have the most boring explanations. I'll work
on a fix.

On Mon, Mar 3, 2025 at 8:11 PM Thomas Munro <thomas.munro@gmail.com> wrote:
> I think that is telling us that a non-blocking socket can be in a
> state that is not yet connected enough even to tell you its local
> address?  That is, connect() returns without having allocated a local
> address, and does that part asynchronously too?  I don't know what to
> think about that yet...

That is also really good to know, though. So that EINVAL message
might, in the end, be completely unrelated to the bug? (Curl doesn't
worry about the error, looks like, just prints it to the debug
stream.)

Thanks!
--Jacob



pgsql-hackers by date:

Previous
From: Melanie Plageman
Date:
Subject: Re: Log connection establishment timings
Next
From: Nathan Bossart
Date:
Subject: Re: vacuumdb changes for stats import/export