Re: [PoC] Federated Authn/z with OAUTHBEARER

Jacob Champion <jacob.champion@enterprisedb.com>

From: Jacob Champion <jacob.champion@enterprisedb.com>

To: Jelte Fennema-Nio <postgres@jeltef.nl>

Cc: Christoph Berg <myon@debian.org>, Peter Eisentraut <peter@eisentraut.org>, Andres Freund <andres@anarazel.de>, Tom Lane <tgl@sss.pgh.pa.us>, Bruce Momjian <bruce@momjian.us>, PostgreSQL Hackers <pgsql-hackers@postgresql.org>, Daniel Gustafsson <daniel@yesql.se>, Thomas Munro <thomas.munro@gmail.com>, Nazir Bilal Yavuz <byavuz81@gmail.com>, Antonin Houska <ah@cybertec.at>, Wolfgang Walther <walther@technowledgy.de>

Date: 2025-04-11T00:12:46Z

Lists: pgsql-hackers

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

meson: Fix install-quiet after clean
- a9ffb35274fb 18.0 landed
- 4ae03be54734 19 (unreleased) landed
oauth: Run Autoconf tests with correct compiler flags
- 3d23f68c5529 18.0 landed
- 990571a08b66 19 (unreleased) landed
Link libpq with libdl if the platform needs that.
- 4df477153a6b 19 (unreleased) landed
- 7bd752c1fb8e 18.0 landed
Doc: correct spelling of meson switch.
- 3faac9d14063 16.9 landed
- 766d2e673342 17.5 landed
- ac557793d478 18.0 landed
oauth: Correct SSL dependency for libpq-oauth.a
- 3db68212a393 18.0 landed
oauth: Fix Autoconf build on macOS
- 4ea1254f35b2 18.0 cited
oauth: Move the builtin flow into a separate module
- b0635bfda053 18.0 landed
Remove a stray "pgrminclude" annotation
- 764d501d24ba 18.0 cited
oauth: Simplify copy of PGoauthBearerRequest
- 1cf4c56480f8 18.0 landed
oauth: Improve validator docs on interruptibility
- 873c0fd67872 18.0 landed
oauth: Disallow synchronous DNS in libcurl
- d7e40845f923 18.0 landed
oauth: Fix postcondition for set_timer on macOS
- 434dbf6907ec 18.0 landed
oauth: Use IPv4-only issuer in oauth_validator tests
- 8d9d5843b55f 18.0 landed
Work around OAuth/EVFILT_TIMER quirk on NetBSD.
- c301a0a74a8a 18.0 landed
oauth: Fix incorrect const markers in struct
- 03366b61dfe5 18.0 landed
Add missing entry to oauth_validator test .gitignore
- 2c53dec7f440 18.0 landed
cirrus: Temporarily fix libcurl link error
- 9d9a71002a1c 18.0 landed
Add support for OAUTHBEARER SASL mechanism
- b3f0be788afc 18.0 landed
libpq: Handle asynchronous actions during SASL
- a99a32e43ed7 18.0 landed
require_auth: prepare for multiple SASL mechanisms
- f8d8581ed882 18.0 landed
Move PG_MAX_AUTH_TOKEN_LENGTH to libpq/auth.h
- e21d6f297158 18.0 landed
Make SASL max message length configurable
- 6d16f9debae0 18.0 landed
jsonapi: fully initialize dummy lexer
- 41b023946dfd 18.0 landed
common/jsonapi: support libpq as a client
- 0785d1b8b2fa 18.0 landed
Remove fe_memutils from libpgcommon_shlib
- f1976df5eaf2 18.0 landed
Revert ECPG's use of pnstrdup()
- f0096ef13be2 13.17 landed
- 3557185538fe 14.14 landed
- 2de129b356bf 15.9 landed
- ee2997c678d8 16.5 landed
- e9e05c655069 17.0 landed
- 5388216f6adc 18.0 landed
Explicitly require password for SCRAM exchange
- adcdb2c8dda4 17.0 landed
Refactor SASL exchange to return tri-state status
- 24178e235ea5 17.0 landed

Attachments

v5-0001-WIP-split-Device-Authorization-flow-into-dlopen-d.patch (application/octet-stream) patch v5-0001

On Wed, Apr 9, 2025 at 4:42 PM Jelte Fennema-Nio <postgres@jeltef.nl> wrote:
> I think your suggestion of not using any .so files would best there (from w user perspective). I'd be quite surprised if a static build still resulted in me having to manage shared library files anyway.

Done this way in v5. I had planned to separate the implementations by
a #define, but I ran into issues with Makefile.shlib, so I split the
shared and dynamic versions into separate files. I just now realized
that we do something about this exact problem in src/common, so I'll
see if I can copy its technique for the next go round.

In the next version, I'll try to add --with-oauth-client while keeping
--with-libcurl as an alias, to let the buildfarm migrate off of it
before it's removed.

Thanks!
--Jacob