MIME-Version: 1.0
References: 
 <CAN4CZFM3b8u5uNNNsY6XCya257u+Dofms3su9f11iMCxvCacag@mail.gmail.com>
 <CAE2r8H55geNFtECuFunpgn0LJK2+rntGuTeqNr6mP7gGhWFRbA@mail.gmail.com>
In-Reply-To: 
 <CAE2r8H55geNFtECuFunpgn0LJK2+rntGuTeqNr6mP7gGhWFRbA@mail.gmail.com>
From: Jacob Champion <jacob.champion@enterprisedb.com>
Date: Wed, 17 Dec 2025 10:27:44 -0800
Message-ID: 
 <CAOYmi+nY9F5J9+m1TEm-LCPVitmfO-9nGp9HW+T_=tmiYH4vAA@mail.gmail.com>
Subject: Re: Custom oauth validator options
To: VASUKI M <vasukianand0119@gmail.com>
Cc: Zsolt Parragi <zsolt.parragi@percona.com>,
	PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>,
 david.g.johnston@gmail.com,
	Robert Haas <robertmhaas@gmail.com>, myon@debian.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: 
 <https://www.postgresql.org/message-id/CAOYmi%2BnY9F5J9%2Bm1TEm-LCPVitmfO-9nGp9HW%2BT_%3DtmiYH4vAA%40mail.gmail.com>
Precedence: bulk

On Tue, Dec 16, 2025 at 10:30=E2=80=AFPM VASUKI M <vasukianand0119@gmail.co=
m> wrote:
> Overall, +1 that this limitation is real and worth discussing.I=E2=80=99l=
l plan to send a patch shortly exploring option (b).

Thanks!

> Reg very long HBA lines: totally agree this is a real readability issue,b=
ut allowing per-line includes or external file feels like a seperate(and mu=
ch bigger)topic,probably best tackled independently.

I forgot to mention in my reply to Zsolt, but we've supported inline
inclusions in HBA for a few releases now. (I just frequently forget
they exist.)

pg_hba.conf:

    hostssl  all  all  0.0.0.0/0  oauth  @oauth-settings.conf

oauth-settings.conf:

    issuer=3Dhttps://oauth.example.org/v2
    scope=3D"openid email let-me-into-pg"
    validator=3Dexample_org
    map=3Dexamplemap

And for smaller annoyances, you can wrap lines with backslash continuation.

I haven't used these new features much, since I forget they exist, so
if there are usability problems in practice please say something so we
can fix it.

--Jacob