Re: [PoC] Federated Authn/z with OAUTHBEARER

On Thu, Oct 10, 2024 at 4:08 PM Jacob Champion
<jacob(dot)champion(at)enterprisedb(dot)com> wrote:
> Here's v30, which aims to fix the infinite-retry problem: you get a
> maximum of two OAuth connections to the server, and we won't prompt
> the user more than once per transport. (I still need to wrap my head
> around the retry behavior during transport negotiation.)

v31 folds in the remainder of the review patch (hooray!) and makes a
change to the 401 handling. If the server doesn't tell the client why
a token request failed, but we see that we got a 401 Unauthorized, the
error message now suggests that the oauth_client_secret setting is
unacceptable.

(If anyone out there happens to be testing this against real-world
implementations, I would love to get your feedback on this failure
mode. I can no longer get Entra ID to require a client secret during a
device flow, the way I used to be able to with Azure AD.)

I've also made the default device prompt translatable.

--Jacob