mirror of
https://github.com/postgres/postgres.git
synced 2026-02-26 19:30:25 -05:00
b3f0be788a
This commit implements OAUTHBEARER, RFC 7628, and OAuth 2.0 Device Authorization Grants, RFC 8628. In order to use this there is a new pg_hba auth method called oauth. When speaking to a OAuth- enabled server, it looks a bit like this: $ psql 'host=example.org oauth_issuer=... oauth_client_id=...' Visit https://oauth.example.org/login and enter the code: FPQ2-M4BG Device authorization is currently the only supported flow so the OAuth issuer must support that in order for users to authenticate. Third-party clients may however extend this and provide their own flows. The built-in device authorization flow is currently not supported on Windows. In order for validation to happen server side a new framework for plugging in OAuth validation modules is added. As validation is implementation specific, with no default specified in the standard, PostgreSQL does not ship with one built-in. Each pg_hba entry can specify a specific validator or be left blank for the validator installed as default. This adds a requirement on libcurl for the client side support, which is optional to build, but the server side has no additional build requirements. In order to run the tests, Python is required as this adds a https server written in Python. Tests are gated behind PG_TEST_EXTRA as they open ports. This patch has been a multi-year project with many contributors involved with reviews and in-depth discussions: Michael Paquier, Heikki Linnakangas, Zhihong Yu, Mahendrakar Srinivasarao, Andrey Chudnovsky and Stephen Frost to name a few. While Jacob Champion is the main author there have been some levels of hacking by others. Daniel Gustafsson contributed the validation module and various bits and pieces; Thomas Munro wrote the client side support for kqueue. Author: Jacob Champion <jacob.champion@enterprisedb.com> Co-authored-by: Daniel Gustafsson <daniel@yesql.se> Co-authored-by: Thomas Munro <thomas.munro@gmail.com> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Reviewed-by: Peter Eisentraut <peter@eisentraut.org> Reviewed-by: Antonin Houska <ah@cybertec.at> Reviewed-by: Kashif Zeeshan <kashi.zeeshan@gmail.com> Discussion: https://postgr.es/m/d1b467a78e0e36ed85a09adf979d04cf124a9d4b.camel@vmware.com
54 lines
2.1 KiB
C
54 lines
2.1 KiB
C
/*-------------------------------------------------------------------------
|
|
*
|
|
* auth.h
|
|
* Definitions for network authentication routines
|
|
*
|
|
*
|
|
* Portions Copyright (c) 1996-2025, PostgreSQL Global Development Group
|
|
* Portions Copyright (c) 1994, Regents of the University of California
|
|
*
|
|
* src/include/libpq/auth.h
|
|
*
|
|
*-------------------------------------------------------------------------
|
|
*/
|
|
#ifndef AUTH_H
|
|
#define AUTH_H
|
|
|
|
#include "libpq/libpq-be.h"
|
|
|
|
/*
|
|
* Maximum accepted size of GSS and SSPI authentication tokens.
|
|
* We also use this as a limit on ordinary password packet lengths.
|
|
*
|
|
* Kerberos tickets are usually quite small, but the TGTs issued by Windows
|
|
* domain controllers include an authorization field known as the Privilege
|
|
* Attribute Certificate (PAC), which contains the user's Windows permissions
|
|
* (group memberships etc.). The PAC is copied into all tickets obtained on
|
|
* the basis of this TGT (even those issued by Unix realms which the Windows
|
|
* realm trusts), and can be several kB in size. The maximum token size
|
|
* accepted by Windows systems is determined by the MaxAuthToken Windows
|
|
* registry setting. Microsoft recommends that it is not set higher than
|
|
* 65535 bytes, so that seems like a reasonable limit for us as well.
|
|
*/
|
|
#define PG_MAX_AUTH_TOKEN_LENGTH 65535
|
|
|
|
extern PGDLLIMPORT char *pg_krb_server_keyfile;
|
|
extern PGDLLIMPORT bool pg_krb_caseins_users;
|
|
extern PGDLLIMPORT bool pg_gss_accept_delegation;
|
|
|
|
extern void ClientAuthentication(Port *port);
|
|
extern void sendAuthRequest(Port *port, AuthRequest areq, const char *extradata,
|
|
int extralen);
|
|
extern void set_authn_id(Port *port, const char *id);
|
|
|
|
/* Hook for plugins to get control in ClientAuthentication() */
|
|
typedef void (*ClientAuthentication_hook_type) (Port *, int);
|
|
extern PGDLLIMPORT ClientAuthentication_hook_type ClientAuthentication_hook;
|
|
|
|
/* hook type for password manglers */
|
|
typedef char *(*auth_password_hook_typ) (char *input);
|
|
|
|
/* Default LDAP password mutator hook, can be overridden by a shared library */
|
|
extern PGDLLIMPORT auth_password_hook_typ ldap_password_hook;
|
|
|
|
#endif /* AUTH_H */
|