Re: Custom oauth validator options
| От | Zsolt Parragi |
|---|---|
| Тема | Re: Custom oauth validator options |
| Дата | |
| Msg-id | CAN4CZFMGwGdMnxP07Rk2qrC9eGQt31Lrerrnk66vQuzRhDEwiw@mail.gmail.com обсуждение исходный текст |
| Ответ на | Re: Custom oauth validator options (Zsolt Parragi <zsolt.parragi@percona.com>) |
| Список | pgsql-hackers |
I've looked into the patch in more detail. (I will post a review later to that thread, I have some notes I have to format properly) As for this use case, we could use this (for my original B or C options), but I see a potential problem: First, we either only use this code to feed the unknown parameters to the options parser, and keep the existing hba options parser as is for the hardcoded parameters. Or also include the fixed options in it, so that everything works exactly the same. Then we either make it limited to oauth validators, or try to keep it generic for any session_preload_libraries. If we only use this for unknown options, and limit it to oauth validators, then options.h/c could work as is. If we want to implement anything more generic, we'll face issues, as the current API only supports validating the input once. In the most generic case: * Parsing the core hba options in postmaster * Validating core options, ignoring unknowns * Loading the oauth validator * Validating options again, as the validator needs its custom options - having unknown remaining options is still valid * Running the validator * Loading session preload libraries * Validating options again - unknown options are an error now So up to 3 times, and it also needs a way for extensions to edit spec sets. (In the simple case, only the validator has to know about that) I think this makes this impractical for the more complex applications, but if we want to go back to the minimal original concept, limited to oauth validators, it could work. I'm also not sure how useful this non-GUC API would be for extensions other than validators, which also tells me that this version should be limited to the validators. Also, this isn't an approach with an easy way to convert it into PGC_HBA, as it requires a clearly different api in the validator - I don't see a nice way to do that without changing the API used by the validators.
В списке pgsql-hackers по дате отправления: