Re: Proposal: Support custom authentication methods using hooks

From: Stephen Frost <sfrost(at)snowman(dot)net>
To: Peter Eisentraut <peter(dot)eisentraut(at)enterprisedb(dot)com>
Cc: samay sharma <smilingsamay(at)gmail(dot)com>, Andres Freund <andres(at)anarazel(dot)de>, PostgreSQL Hackers <pgsql-hackers(at)lists(dot)postgresql(dot)org>
Subject: Re: Proposal: Support custom authentication methods using hooks
Date: 2022-03-03 17:39:01
Views: Raw Message | Whole Thread | Download mbox | Resend email
Lists: pgsql-hackers


* Peter Eisentraut (peter(dot)eisentraut(at)enterprisedb(dot)com) wrote:
> On 02.03.22 21:49, samay sharma wrote:
> >I think we are discussing two topics in this thread which in my opinion
> >are orthogonal.
> >
> >(a) Should we make authentication methods pluggable by exposing these
> >hooks? - These will allow users to add plugins of their own to support
> >whatever auth method they like. One immediate use case (and what prompted
> >me to start looking at this) is Azure Active Directory integration which
> >is a common request from Azure customers. We could also, over time, move
> >some of our existing auth methods into extensions if we don’t want to
> >maintain them in core.
> I don't think people are necessarily opposed to that.

I'm not thrilled with it, at least. It's not clear that just backend
hooks would be enough either- certainly a number of our existing
mechanisms require support in libpq and those are generally the ones
that are more secure too (GSSAPI, Certs), so how would that work with
something that's 'pluggable'? Are we going to have libpq loading in
libraries too?

> At the moment, it is not possible to judge whether the hook interface you
> have chosen is appropriate.


> I suggest you actually implement the Azure provider, then make the hook
> interface, and then show us both and we can see what to do with it.

Better- implement a standard that's also supported by Azure and not
something proprietary that can't be evaluated or which hasn't been
reviewed by security experts.



In response to

Browse pgsql-hackers by date

  From Date Subject
Next Message Stephen Frost 2022-03-03 17:40:47 Re: Problem with moderation of messages with patched attached.
Previous Message Jonathan S. Katz 2022-03-03 17:38:32 Re: Proposal: Support custom authentication methods using hooks