RDS IAM authorization connection times out

[danscratch]

Hi everyone,

I've been setting up my system with the PostgresAdapter, and I've noticed that when I used username/password to get a pool, everything works fine. But when I use RDS IAM authentication, it works initially, then the connection times out after some period of inactivity. Here is the error message:

[auth][details]: {}
[auth][error] SessionTokenError: Read more at https://errors.authjs.dev#sessiontokenerror
[auth][cause]: error: PAM authentication failed for user "myuser"
    at /Users/daniel/dev/myproject/node_modules/.pnpm/pg-pool@3.6.2_pg@8.12.0/node_modules/pg-pool/index.js:45:11
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Object.getSessionAndUser (webpack-internal:///(rsc)/./node_modules/.pnpm/@auth+pg-adapter@1.4.1_pg@8.12.0/node_modules/@auth/pg-adapter/index.js:171:29)
    at async acc.<computed> (webpack-internal:///(rsc)/./node_modules/.pnpm/@auth+core@0.32.0/node_modules/@auth/core/lib/init.js:178:24)
    at async Module.session (webpack-internal:///(rsc)/./node_modules/.pnpm/@auth+core@0.32.0/node_modules/@auth/core/lib/actions/session.js:67:30)
    at async AuthInternal (webpack-internal:///(rsc)/./node_modules/.pnpm/@auth+core@0.32.0/node_modules/@auth/core/lib/index.js:47:24)
    at async Auth (webpack-internal:///(rsc)/./node_modules/.pnpm/@auth+core@0.32.0/node_modules/@auth/core/index.js:126:34)
    at async /Users/daniel/dev/myproject/node_modules/.pnpm/next@14.2.5_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/next/dist/compiled/next-server/app-route.runtime.dev.js:6:55038
    at async ek.execute (/Users/daniel/dev/myproject/node_modules/.pnpm/next@14.2.5_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/next/dist/compiled/next-server/app-route.runtime.dev.js:6:45808)
...

It looks like it's breaking in the getSessionAndUser() function in the PostgresAdapter. Here's the code I use to connect:

    // c.f. https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-rds-signer/
    const signer = new Signer({
      hostname: process.env.POSTGRES_HOST,
      port: process.env.POSTGRES_PORT,
      username: process.env.POSTGRES_USER,
      region: process.env.AWS_REGION,
    });
    const password = await signer.getAuthToken();
    const user = process.env.POSTGRES_USER;
    const ca = fs.readFileSync(process.env.NODE_EXTRA_CA_CERTS).toString();
    pool = new Pool({
      host: process.env.POSTGRES_HOST,
      database: process.env.POSTGRES_DATABASE,
      user,
      password,
      max: 20,
      idleTimeoutMillis: 30000,
      connectionTimeoutMillis: 2000,
      ssl: {
        rejectUnauthorized: false,
        ca,
      },
    });

Again – this all works until it times out, at which point it crashes catastrophically. This isn't a problem in the rest of my code, because I can either try-catch, or just get a new pool with a new token after some period of inactivity.

Has anyone gotten RDS IAM authentication to work?