Re: [PoC] Federated Authn/z with OAUTHBEARER

Поиск
Список
Период
Сортировка
От Jacob Champion
Тема Re: [PoC] Federated Authn/z with OAUTHBEARER
Дата
Msg-id CAAWbhmgTnF4xN4JhCg2=GEOYOdHTx3LLvc7ZVyqmMm56jpNLhQ@mail.gmail.com
обсуждение исходный текст
Ответ на Re: [PoC] Federated Authn/z with OAUTHBEARER  (Daniele Varrazzo <daniele.varrazzo@gmail.com>)
Список pgsql-hackers
On Tue, May 23, 2023 at 4:22 AM Daniele Varrazzo
<daniele.varrazzo@gmail.com> wrote:
> On Sat, 20 May 2023 at 00:01, Jacob Champion <jchampion@timescale.com> wrote:
> > - Some clients in the wild (psycopg2/psycopg) suppress all notifications
> > during PQconnectPoll().
>
> If there is anything we can improve in psycopg please reach out.

Will do, thank you! But in this case, I think there's nothing to
improve in psycopg -- in fact, it highlighted the problem with my
initial design, and now I think the notice processor will never be an
appropriate avenue for communication of the user code.

The biggest issue is that there's a chicken-and-egg situation: if
you're using the synchronous PQconnect* API, you can't override the
notice hooks while the handshake is in progress, because you don't
have a connection handle yet. The second problem is that there are a
bunch of parameters coming back from the server (user code,
verification URI, expiration time) that the application may choose to
display or use, and communicating those pieces in a (probably already
translated) flat text string is a pretty hostile API.

So I think we'll probably need to provide a global handler API,
similar to the passphrase hook we currently provide, that can receive
these pieces separately and assemble them however the application
desires. The hard part will be to avoid painting ourselves into a
corner, because this particular information is specific to the device
authorization flow, and if we ever want to add other flows into libpq,
we'll probably not want to add even more hooks.

Thanks,
--Jacob



В списке pgsql-hackers по дате отправления:

Предыдущее
От: Robert Haas
Дата:
Сообщение: Re: pgsql: TAP test for logical decoding on standby
Следующее
От: Tomas Vondra
Дата:
Сообщение: memory leak in trigger handling (since PG12)