Re: [PoC] Federated Authn/z with OAUTHBEARER

Jacob Champion <jacob.champion@enterprisedb.com>

From: Jacob Champion <jacob.champion@enterprisedb.com>

To: Nathan Bossart <nathandbossart@gmail.com>

Cc: Daniel Gustafsson <daniel@yesql.se>, Christoph Berg <myon@debian.org>, Jelte Fennema-Nio <postgres@jeltef.nl>, Peter Eisentraut <peter@eisentraut.org>, Andres Freund <andres@anarazel.de>, Tom Lane <tgl@sss.pgh.pa.us>, Bruce Momjian <bruce@momjian.us>, PostgreSQL Hackers <pgsql-hackers@postgresql.org>, Thomas Munro <thomas.munro@gmail.com>, Nazir Bilal Yavuz <byavuz81@gmail.com>, Antonin Houska <ah@cybertec.at>, Wolfgang Walther <walther@technowledgy.de>, Devrim Gündüz <devrim@gunduz.org>

Date: 2025-05-02T17:05:26Z

Lists: pgsql-hackers

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

meson: Fix install-quiet after clean
- a9ffb35274fb 18.0 landed
- 4ae03be54734 19 (unreleased) landed
oauth: Run Autoconf tests with correct compiler flags
- 3d23f68c5529 18.0 landed
- 990571a08b66 19 (unreleased) landed
Link libpq with libdl if the platform needs that.
- 4df477153a6b 19 (unreleased) landed
- 7bd752c1fb8e 18.0 landed
Doc: correct spelling of meson switch.
- 3faac9d14063 16.9 landed
- 766d2e673342 17.5 landed
- ac557793d478 18.0 landed
oauth: Correct SSL dependency for libpq-oauth.a
- 3db68212a393 18.0 landed
oauth: Fix Autoconf build on macOS
- 4ea1254f35b2 18.0 cited
oauth: Move the builtin flow into a separate module
- b0635bfda053 18.0 landed
Remove a stray "pgrminclude" annotation
- 764d501d24ba 18.0 cited
oauth: Simplify copy of PGoauthBearerRequest
- 1cf4c56480f8 18.0 landed
oauth: Improve validator docs on interruptibility
- 873c0fd67872 18.0 landed
oauth: Disallow synchronous DNS in libcurl
- d7e40845f923 18.0 landed
oauth: Fix postcondition for set_timer on macOS
- 434dbf6907ec 18.0 landed
oauth: Use IPv4-only issuer in oauth_validator tests
- 8d9d5843b55f 18.0 landed
Work around OAuth/EVFILT_TIMER quirk on NetBSD.
- c301a0a74a8a 18.0 landed
oauth: Fix incorrect const markers in struct
- 03366b61dfe5 18.0 landed
Add missing entry to oauth_validator test .gitignore
- 2c53dec7f440 18.0 landed
cirrus: Temporarily fix libcurl link error
- 9d9a71002a1c 18.0 landed
Add support for OAUTHBEARER SASL mechanism
- b3f0be788afc 18.0 landed
libpq: Handle asynchronous actions during SASL
- a99a32e43ed7 18.0 landed
require_auth: prepare for multiple SASL mechanisms
- f8d8581ed882 18.0 landed
Move PG_MAX_AUTH_TOKEN_LENGTH to libpq/auth.h
- e21d6f297158 18.0 landed
Make SASL max message length configurable
- 6d16f9debae0 18.0 landed
jsonapi: fully initialize dummy lexer
- 41b023946dfd 18.0 landed
common/jsonapi: support libpq as a client
- 0785d1b8b2fa 18.0 landed
Remove fe_memutils from libpgcommon_shlib
- f1976df5eaf2 18.0 landed
Revert ECPG's use of pnstrdup()
- f0096ef13be2 13.17 landed
- 3557185538fe 14.14 landed
- 2de129b356bf 15.9 landed
- ee2997c678d8 16.5 landed
- e9e05c655069 17.0 landed
- 5388216f6adc 18.0 landed
Explicitly require password for SCRAM exchange
- adcdb2c8dda4 17.0 landed
Refactor SASL exchange to return tri-state status
- 24178e235ea5 17.0 landed

Attachments

0001-oauth-Correct-SSL-dependency-for-libpq-oauth.a.patch (application/octet-stream) patch 0001

On Fri, May 2, 2025 at 8:59 AM Jacob Champion
<jacob.champion@enterprisedb.com> wrote:
> libintl is already coming in via frontend_stlib_code, so that's fine.
> So now I'm wondering if any other static clients of libpq-int.h (if
> there are any) need the ssl dependency too, for correctness, or if
> it's just me.

Looks like it's just me. And using partial_dependency for the includes
seems like overkill, so I've kept the full ssl dependency object, but
moved it to the staticlib only, which is enough to solve the breakage
on my machine.

Nathan, if you get a chance, does the attached patch work for you?

Thanks!
--Jacob