MIME-Version: 1.0
References: 
 <CAN4CZFPmF9fGOcFubwOxqXymhVo_RvbUx3bLoYQcfk=f0mwECw@mail.gmail.com>
 <202601281620.m3hrqtih5b2w@alvherre.pgsql>
 <CAN4CZFPUfTj-BF-m5=F7_MnY_T3+Qh-DuG7N7ojdbJDkT8JHeA@mail.gmail.com>
 <fd412b8e-fab5-43fe-b18d-3e035e4998a7@nataraj.su>
 <CAN4CZFMCh3vOWGPbU5pTB-bwnoAtgFuDJmGGv7z7xeez+WJiag@mail.gmail.com>
 <CAN4CZFMGwGdMnxP07Rk2qrC9eGQt31Lrerrnk66vQuzRhDEwiw@mail.gmail.com>
 <CAOYmi+nTXGcroZD_Mnkc8LYWYFbfDYNR4ML_yQ5sF9+DY2amcg@mail.gmail.com>
In-Reply-To: 
 <CAOYmi+nTXGcroZD_Mnkc8LYWYFbfDYNR4ML_yQ5sF9+DY2amcg@mail.gmail.com>
From: Zsolt Parragi <zsolt.parragi@percona.com>
Date: Mon, 23 Mar 2026 21:45:38 +0000
Message-ID: 
 <CAN4CZFMxQzFD0ZJS7pX5Ajdei7TmpROEZKG5vxmfmhCQEQX3fA@mail.gmail.com>
Subject: Re: Custom oauth validator options
To: Jacob Champion <jacob.champion@enterprisedb.com>
Cc: Nikolay Shaplov <dhyan@nataraj.su>,
 =?UTF-8?Q?=C3=81lvaro_Herrera?= <alvherre@kurilemu.de>,
	VASUKI M <vasukianand0119@gmail.com>,
	PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>,
 david.g.johnston@gmail.com,
	Robert Haas <robertmhaas@gmail.com>, myon@debian.org
Content-Type: text/plain; charset="UTF-8"
Archived-At: 
 <https://www.postgresql.org/message-id/CAN4CZFMxQzFD0ZJS7pX5Ajdei7TmpROEZKG5vxmfmhCQEQX3fA%40mail.gmail.com>
Precedence: bulk

> I considered letting this lapse for 19 instead

That was also my conclusion. After the discussion in the SNI thread I
started working on a PoC for a more modern syntax for hba/ident/hosts,
hoping that a generic extensibility/guc patch could be based on that.
I also didn't want to start a thread about this before the feature
freeze, so I'm still waiting/prototyping for a few weeks.

I'm also not against adding an oauth-only feature for 19, that was my
original intention before getting completely distracted by the guc
direction :)

+ else if (strncmp(name, "validator.", strlen("validator.")) == 0)
+ {
+ const char *key = name + strlen("validator.");

This is my only concern with this patch: since we have a list
separated validatr names as a GUC already, couldn't we require a
<validator_name>. prefix instead of the fixed "validator.", to keep
the hba configuration consistent with gucs?

Validators would still have to handle these options differently, but
at least it would look consistent from the user perspective - global
setting in postgresql.conf, same hba-line specific override in
pg_hba.conf. (also, validators already added global GUCs in pg18, and
this would also keep it consistent with that)


+ REQUIRE_AUTH_OPTION(uaOAuth, name, "oauth");

Shouldn't this check go before the name validation?