Re: [PoC] Federated Authn/z with OAUTHBEARER

Christoph Berg <myon@debian.org>

From: Christoph Berg <myon@debian.org>

To: Jacob Champion <jacob.champion@enterprisedb.com>

Cc: Jelte Fennema-Nio <postgres@jeltef.nl>, Peter Eisentraut <peter@eisentraut.org>, Andres Freund <andres@anarazel.de>, Tom Lane <tgl@sss.pgh.pa.us>, Bruce Momjian <bruce@momjian.us>, PostgreSQL Hackers <pgsql-hackers@postgresql.org>, Daniel Gustafsson <daniel@yesql.se>, Thomas Munro <thomas.munro@gmail.com>, Nazir Bilal Yavuz <byavuz81@gmail.com>, Antonin Houska <ah@cybertec.at>, Wolfgang Walther <walther@technowledgy.de>, Devrim Gündüz <devrim@gunduz.org>

Date: 2025-04-23T15:39:08Z

Lists: pgsql-hackers

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

meson: Fix install-quiet after clean
- a9ffb35274fb 18.0 landed
- 4ae03be54734 19 (unreleased) landed
oauth: Run Autoconf tests with correct compiler flags
- 3d23f68c5529 18.0 landed
- 990571a08b66 19 (unreleased) landed
Link libpq with libdl if the platform needs that.
- 4df477153a6b 19 (unreleased) landed
- 7bd752c1fb8e 18.0 landed
Doc: correct spelling of meson switch.
- 3faac9d14063 16.9 landed
- 766d2e673342 17.5 landed
- ac557793d478 18.0 landed
oauth: Correct SSL dependency for libpq-oauth.a
- 3db68212a393 18.0 landed
oauth: Fix Autoconf build on macOS
- 4ea1254f35b2 18.0 cited
oauth: Move the builtin flow into a separate module
- b0635bfda053 18.0 landed
Remove a stray "pgrminclude" annotation
- 764d501d24ba 18.0 cited
oauth: Simplify copy of PGoauthBearerRequest
- 1cf4c56480f8 18.0 landed
oauth: Improve validator docs on interruptibility
- 873c0fd67872 18.0 landed
oauth: Disallow synchronous DNS in libcurl
- d7e40845f923 18.0 landed
oauth: Fix postcondition for set_timer on macOS
- 434dbf6907ec 18.0 landed
oauth: Use IPv4-only issuer in oauth_validator tests
- 8d9d5843b55f 18.0 landed
Work around OAuth/EVFILT_TIMER quirk on NetBSD.
- c301a0a74a8a 18.0 landed
oauth: Fix incorrect const markers in struct
- 03366b61dfe5 18.0 landed
Add missing entry to oauth_validator test .gitignore
- 2c53dec7f440 18.0 landed
cirrus: Temporarily fix libcurl link error
- 9d9a71002a1c 18.0 landed
Add support for OAUTHBEARER SASL mechanism
- b3f0be788afc 18.0 landed
libpq: Handle asynchronous actions during SASL
- a99a32e43ed7 18.0 landed
require_auth: prepare for multiple SASL mechanisms
- f8d8581ed882 18.0 landed
Move PG_MAX_AUTH_TOKEN_LENGTH to libpq/auth.h
- e21d6f297158 18.0 landed
Make SASL max message length configurable
- 6d16f9debae0 18.0 landed
jsonapi: fully initialize dummy lexer
- 41b023946dfd 18.0 landed
common/jsonapi: support libpq as a client
- 0785d1b8b2fa 18.0 landed
Remove fe_memutils from libpgcommon_shlib
- f1976df5eaf2 18.0 landed
Revert ECPG's use of pnstrdup()
- f0096ef13be2 13.17 landed
- 3557185538fe 14.14 landed
- 2de129b356bf 15.9 landed
- ee2997c678d8 16.5 landed
- e9e05c655069 17.0 landed
- 5388216f6adc 18.0 landed
Explicitly require password for SCRAM exchange
- adcdb2c8dda4 17.0 landed
Refactor SASL exchange to return tri-state status
- 24178e235ea5 17.0 landed

Re: Jacob Champion
> - Per ABI comment upthread, we are back to major-minor versioning for
> the shared library (e.g. libpq-oauth-18-0.so). 0001 adds the macros
> and makefile variables to make this easy, and 0002 is the bulk of the
> change now.

This will cause problems when programs are running while packages are
updated on disk. That program then tries to dlopen 18-0.so when there
is already 18-1.so installed. Relevant when the first oauth connection
is made way after startup.

This is trading one problem for another, but within-a-major ABI
changes should be much rarer than normal minor updates with
applications restarting only later.

Alternatively, there could be a dedicated SONAME for the plugin that
only changes when necessary, but perhaps the simple "18.so" solution
is good enough.

Christoph