MIME-Version: 1.0
References: 
 <CAN4CZFM3b8u5uNNNsY6XCya257u+Dofms3su9f11iMCxvCacag@mail.gmail.com>
 <CAE2r8H55geNFtECuFunpgn0LJK2+rntGuTeqNr6mP7gGhWFRbA@mail.gmail.com>
 <CAN4CZFP_2fe2-18wUoXDZodV8suVe9o++pv=hP8KxxvWkmCx7A@mail.gmail.com>
 <CAOYmi+kMuA7t9ao6rWZ=5kn_Zmd7qtwOay_ocEBXwkzKWbefhQ@mail.gmail.com>
In-Reply-To: 
 <CAOYmi+kMuA7t9ao6rWZ=5kn_Zmd7qtwOay_ocEBXwkzKWbefhQ@mail.gmail.com>
From: VASUKI M <vasukianand0119@gmail.com>
Date: Thu, 18 Dec 2025 10:44:05 +0530
Message-ID: 
 <CAE2r8H439jg+e5gXJpNNMoroe4CfWauDRfUBZC_9NUNTOhqzBQ@mail.gmail.com>
Subject: Re: Custom oauth validator options
To: Jacob Champion <jacob.champion@enterprisedb.com>
Cc: Zsolt Parragi <zsolt.parragi@percona.com>,
	PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>,
 david.g.johnston@gmail.com,
	Robert Haas <robertmhaas@gmail.com>, myon@debian.org
Content-Type: multipart/alternative; boundary="000000000000bdb2540646330647"
Archived-At: 
 <https://www.postgresql.org/message-id/CAE2r8H439jg%2Be5gXJpNNMoroe4CfWauDRfUBZC_9NUNTOhqzBQ%40mail.gmail.com>
Precedence: bulk

--000000000000bdb2540646330647
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, Dec 18, 2025 at 12:31=E2=80=AFAM Jacob Champion <
jacob.champion@enterprisedb.com> wrote:

> On Wed, Dec 17, 2025 at 1:28=E2=80=AFAM Zsolt Parragi <zsolt.parragi@perc=
ona.com>
> wrote:
> > Instead we decided to let everyone configure which claim they want to
> > use for user mapping. But because of that, this is a GUC, and they can
> > only configure it once pre server.
>
> We're getting closer; I agree that this needs to be more flexible than
> it is, and I'm on board with a change, but I'm still missing the
> "killer app". What's the case where a user has multiple HBA lines that
> all want to use unrelated claims for authentication to one Postgres
> cluster? Is this multi-tenancy, or...?
>
> Beyond multitenancy,per -HBA OAuth  cases where options are needed for
safe provider migration[blue/green],per-database security policies,mixed
Human/machine authentication[JWT/Introspection] and incident-response
scenarios -all global GUCs are too coarse.

See also the old conversation regarding LDAP hba/ident
> [1]
>
> [1]
> https://postgr.es/m/CAOuzzgpFpuroNRabEvB9kST_TSyS2jFicBNoXvW7G2pZFixyBw%4=
0mail.gmail.com


 Thanks, Will go through it.

Regards,

Vasuki M
CDAC,Chennai.

--000000000000bdb2540646330647
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote g=
mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Thu, Dec 18,=
 2025 at 12:31=E2=80=AFAM Jacob Champion &lt;<a href=3D"mailto:jacob.champi=
on@enterprisedb.com">jacob.champion@enterprisedb.com</a>&gt; wrote:<br></di=
v><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;borde=
r-left:1px solid rgb(204,204,204);padding-left:1ex">On Wed, Dec 17, 2025 at=
 1:28=E2=80=AFAM Zsolt Parragi &lt;<a href=3D"mailto:zsolt.parragi@percona.=
com" target=3D"_blank">zsolt.parragi@percona.com</a>&gt; wrote:<br>
&gt; Instead we decided to let everyone configure which claim they want to<=
br>
&gt; use for user mapping. But because of that, this is a GUC, and they can=
<br>
&gt; only configure it once pre server.<br>
<br>
We&#39;re getting closer; I agree that this needs to be more flexible than<=
br>
it is, and I&#39;m on board with a change, but I&#39;m still missing the<br=
>
&quot;killer app&quot;. What&#39;s the case where a user has multiple HBA l=
ines that<br>
all want to use unrelated claims for authentication to one Postgres<br>
cluster? Is this multi-tenancy, or...?<br>
<br></blockquote><div>Beyond multitenancy,per -HBA OAuth=C2=A0 cases where =
options are needed for safe provider migration[blue/green],per-database sec=
urity policies,mixed Human/machine authentication[JWT/Introspection] and in=
cident-response scenarios -all global GUCs are too coarse.<br><br></div><bl=
ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef=
t:1px solid rgb(204,204,204);padding-left:1ex">See also the old conversatio=
n regarding LDAP hba/ident<br>
[1]<br>
<br>
[1] <a href=3D"https://postgr.es/m/CAOuzzgpFpuroNRabEvB9kST_TSyS2jFicBNoXvW=
7G2pZFixyBw%40mail.gmail.com" rel=3D"noreferrer" target=3D"_blank">https://=
postgr.es/m/CAOuzzgpFpuroNRabEvB9kST_TSyS2jFicBNoXvW7G2pZFixyBw%40mail.gmai=
l.com</a></blockquote><div><br>=C2=A0Thanks, Will go through it.<br><br>Reg=
ards,<br><br>Vasuki M<br>CDAC,Chennai.</div></div></div>

--000000000000bdb2540646330647--