public inbox for [email protected]  

help / color / mirror / Atom feed

From: Jacob Champion <[email protected]>
To: Daniele Varrazzo <[email protected]>
Cc: [email protected] <[email protected]>
Cc: mahendrakar s <[email protected]>
Cc: Andrey Chudnovsky <[email protected]>
Cc: [email protected] <[email protected]>
Cc: [email protected] <[email protected]>
Cc: [email protected] <[email protected]>
Cc: Stephen Frost <[email protected]>
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
Date: Tue, 23 May 2023 08:56:47 -0700
Message-ID: <CAAWbhmgTnF4xN4JhCg2=GEOYOdHTx3LLvc7ZVyqmMm56jpNLhQ@mail.gmail.com> (raw)
In-Reply-To: <CA+mi_8YDA4S6o0=1TX5a=czKxq_peZpgOax6Jt0Kz1QXEnTZfw@mail.gmail.com>
References: <[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>
	<CAAWbhmiWudPQk2euOQQPPa=o14zCN9U_qLwU1pShKO4A-F9yeA@mail.gmail.com>
	<CAAWbhmgWHhqVUkd0nRh59OpVpy_ewfUimqx+NMaWwGNqk=660g@mail.gmail.com>
	<[email protected]>
	<CA+mi_8YDA4S6o0=1TX5a=czKxq_peZpgOax6Jt0Kz1QXEnTZfw@mail.gmail.com>

On Tue, May 23, 2023 at 4:22 AM Daniele Varrazzo
<[email protected]> wrote:
> On Sat, 20 May 2023 at 00:01, Jacob Champion <[email protected]> wrote:
> > - Some clients in the wild (psycopg2/psycopg) suppress all notifications
> > during PQconnectPoll().
>
> If there is anything we can improve in psycopg please reach out.

Will do, thank you! But in this case, I think there's nothing to
improve in psycopg -- in fact, it highlighted the problem with my
initial design, and now I think the notice processor will never be an
appropriate avenue for communication of the user code.

The biggest issue is that there's a chicken-and-egg situation: if
you're using the synchronous PQconnect* API, you can't override the
notice hooks while the handshake is in progress, because you don't
have a connection handle yet. The second problem is that there are a
bunch of parameters coming back from the server (user code,
verification URI, expiration time) that the application may choose to
display or use, and communicating those pieces in a (probably already
translated) flat text string is a pretty hostile API.

So I think we'll probably need to provide a global handler API,
similar to the passphrase hook we currently provide, that can receive
these pieces separately and assemble them however the application
desires. The hard part will be to avoid painting ourselves into a
corner, because this particular information is specific to the device
authorization flow, and if we ever want to add other flows into libpq,
we'll probably not want to add even more hooks.

Thanks,
--Jacob

view thread (3+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
  Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
  In-Reply-To: <CAAWbhmgTnF4xN4JhCg2=GEOYOdHTx3LLvc7ZVyqmMm56jpNLhQ@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox