Subject: [pgjdbc/pgjdbc] issue #3816: Implement OAUTHBEARER to support PostgreSQL 18 OAuth flow

From: "vlsi (@vlsi)" <[email-masked]>
Date: Fri, 26 Sep 2025 06:53:06 +0000

See https://github.com/ongres/scram/issues/108

Looks like adding OAUTHBEARER support would be valuable addition to move towards short-lived tokens: https://chatgpt.com/share/68d634d4-3c14-800f-b8e1-a3e4fd5cb6d9

---

From: "artemgavrilov (@artemgavrilov)" <[email-masked]>
Date: Mon, 04 May 2026 16:31:46 +0000

Hi @vlsi , I would like to work on this and I need some help to plan implementation.  I have couple of questions and will appreciate any help:

1. I got response from ongres/scram maintainer that OAUTH support is out of scope for them. So I plan to implement the support completely within this project. Is it fine?
2. OAUTH uses JSON for request/response. Can I add some library to handle serialization? If yes do you have any preference? 
3. There are two scenarios:
   a) User already has token and just passes it during initialization. In fact it should be lambda func that returns token as app may want to refresh it.
   b) User don't have any token, makes empty auth request and PG returns info from obtaining token. Here libpq has injection point where custom logic can be added while by default it just logs this information. Does pgjdbc need injection point as well and what should be the default behavior?

---

From: "davecramer (@davecramer)" <[email-masked]>
Date: Mon, 04 May 2026 17:08:33 +0000

I would really prefer not to add a dependency if possible. How much JSON are we talking about ?

---

From: "artemgavrilov (@artemgavrilov)" <[email-masked]>
Date: Mon, 04 May 2026 21:24:36 +0000

Hi @davecramer , not much at all! It seems that it's only for error response, so it's parsing of one json with 3 text fields. Not big deal to handle this, just want to be sure about requirements before touching the code.

---

From: "davecramer (@davecramer)" <[email-masked]>
Date: Tue, 05 May 2026 09:59:40 +0000

> Hi [@vlsi](https://github.com/vlsi) , I would like to work on this and I need some help to plan implementation. I have couple of questions and will appreciate any help:
> 

I think we want b) which will allow us to call out to functions to get input

Dave

---

From: "artemgavrilov (@artemgavrilov)" <[email-masked]>
Date: Tue, 05 May 2026 10:20:33 +0000

Great, thank you! In fact it will be a+b then. I just wanted to know if `b` makes sense at all as some drivers do not implement it.

---

From: "sehrope (@sehrope)" <[email-masked]>
Date: Tue, 05 May 2026 12:54:47 +0000

>  User don't have any token, makes empty auth request and PG returns info from obtaining token. Here libpq has injection point where custom logic can be added while by default it just logs this information. Does pgjdbc need injection point as well and what should be the default behavior?

Don't we already have something like this via AuthenticationPlugin?

https://github.com/pgjdbc/pgjdbc/blob/master/pgjdbc/src/main/java/org/postgresql/plugin/AuthenticationPlugin.java

---

From: "artemgavrilov (@artemgavrilov)" <[email-masked]>
Date: Tue, 05 May 2026 14:09:30 +0000

> https://github.com/pgjdbc/pgjdbc/blob/master/pgjdbc/src/main/java/org/postgresql/plugin/AuthenticationPlugin.java

Yep, probably this interface can be extended with something like this:
```
// This differs from getPassword in the way were it's invoked. Password can be fetched when authenticator created because 
// it hasn't TTL, while token should be fetched right before connection creation. This method will cover case A, when user 
// knows how and where to obtain token.
char @Nullable [] getToken(AuthenticationRequestType type) throws PSQLException;

// This is for case B, when PG returns information how to obtain token. If this method is not implemented we may fallback to
// just logging this info. 
char @Nullable [] getToken(AuthenticationRequestType type, Scope scope, URL url) throws PSQLException;
```

Please note that it's just a high level thoughts, I'm still digging sources to find a proper solution.