Re: [PoC] Federated Authn/z with OAUTHBEARER - Mailing list pgsql-hackers

From Andres Freund
Subject Re: [PoC] Federated Authn/z with OAUTHBEARER
Date
Msg-id f6hq3jauvwgo24q5nv3r3ztoc3bheruod6vuajjgifeuxvdyth@y4toolxslt4y
Whole thread Raw
In response to Re: [PoC] Federated Authn/z with OAUTHBEARER  (Jacob Champion <jacob.champion@enterprisedb.com>)
List pgsql-hackers
Hi,

On 2025-04-04 17:27:46 -0700, Jacob Champion wrote:
> += Load-Time ABI =
> +
> +This module ABI is an internal implementation detail, so it's subject to change
> +without warning, even during minor releases (however unlikely). The compiled
> +version of libpq-oauth should always match the compiled version of libpq.

Shouldn't we then include the *minor* version in the soname? I think otherwise
we run into the danger of the wrong library version being loaded in some
cases. Imagine a program being told with libpq to use via rpath. But then we
load the oauth module via a dlopen without a specified path - it'll just
search the global library locations.

Which actually makes me wonder if we ought to instead load the library from a
specific location...


> +TODO
> diff --git a/src/interfaces/libpq-oauth/exports.txt b/src/interfaces/libpq-oauth/exports.txt
> new file mode 100644
> index 00000000000..3787b388e04
> --- /dev/null
> +++ b/src/interfaces/libpq-oauth/exports.txt
> @@ -0,0 +1,4 @@
> +# src/interfaces/libpq-oauth/exports.txt
> +pg_fe_run_oauth_flow      1
> +pg_fe_cleanup_oauth_flow  2
> +pg_g_threadlock           3

The pg_g_threadlock thing seems pretty ugly. Can't we just pass that to the
relevant functions?  But more fundamentally, are we actually using
pg_g_threadlock anywhere? I removed all the releant code and the tests still
seem to pass?


> diff --git a/src/interfaces/libpq-oauth/meson.build b/src/interfaces/libpq-oauth/meson.build
> new file mode 100644
> index 00000000000..1834afbf7a5
> --- /dev/null
> +++ b/src/interfaces/libpq-oauth/meson.build
> @@ -0,0 +1,32 @@
> +# Copyright (c) 2022-2025, PostgreSQL Global Development Group
> +
> +if not libcurl.found() or host_system == 'windows'
> +  subdir_done()
> +endif

Why does this not work on windows? I don't see similar code in the removed
lines?

Greetings,

Andres Freund



pgsql-hackers by date:

Previous
From: Peter Eisentraut
Date:
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
Next
From: Andres Freund
Date:
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER