Date: Mon, 31 Mar 2025 16:06:49 +0200
From: Christoph Berg <myon@debian.org>
To: Andres Freund <andres@anarazel.de>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Bruce Momjian <bruce@momjian.us>,
	Jacob Champion <jacob.champion@enterprisedb.com>,
	PostgreSQL Hackers <pgsql-hackers@postgresql.org>,
	Daniel Gustafsson <daniel@yesql.se>,
	Thomas Munro <thomas.munro@gmail.com>,
	Nazir Bilal Yavuz <byavuz81@gmail.com>,
	Peter Eisentraut <peter@eisentraut.org>,
	Antonin Houska <ah@cybertec.at>
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
Message-ID: <Z-qheTno9lYmjrJu@msg.df7cb.de>
Mail-Followup-To: Christoph Berg <myon@debian.org>,
	Andres Freund <andres@anarazel.de>, Tom Lane <tgl@sss.pgh.pa.us>,
	Bruce Momjian <bruce@momjian.us>,
	Jacob Champion <jacob.champion@enterprisedb.com>,
	PostgreSQL Hackers <pgsql-hackers@postgresql.org>,
	Daniel Gustafsson <daniel@yesql.se>,
	Thomas Munro <thomas.munro@gmail.com>,
	Nazir Bilal Yavuz <byavuz81@gmail.com>,
	Peter Eisentraut <peter@eisentraut.org>,
	Antonin Houska <ah@cybertec.at>
References: 
 <CA+hUKG+dMm6FyQvXM2oD269u6BBnaDoPM4DEyYzZJK6SAFCEag@mail.gmail.com>
 <636879.1742357835@sss.pgh.pa.us>
 <CA+hUKGKCYRS34L+BUy!5qhMF55Zg-oCMxDhnSgqm0jWkP+6jYBA@mail.gmail.com>
 <641687.1742360249@sss.pgh.pa.us>
 <A50E37E8-05A4-4406-945D-14C757AE4AD6@yesql.se>
 <Z9taYF0kIuv42N8e@momjian.us>
 <CAOYmi+kn+NYA=DNMZds8sPXonAFg3dJnTgQ+vsOMXsk1Yz+3Gg@mail.gmail.com>
 <Z9x_sUXIFz8rjvBN@momjian.us>
 <1120967.1742504934@sss.pgh.pa.us>
 <wbqaa72xxfnqtsspanbteoycmtpb6oshtwbrm7uwiw3pur4ll4@tybxmaasfjkv>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <wbqaa72xxfnqtsspanbteoycmtpb6oshtwbrm7uwiw3pur4ll4@tybxmaasfjkv>
Archived-At: 
 <https://www.postgresql.org/message-id/Z-qheTno9lYmjrJu%40msg.df7cb.de>
Precedence: bulk

Re: Andres Freund
> > Yes.  Also, none of this has addressed my complaint about the extent
> > of the build and install dependencies.  Yes, simply not selecting
> > --with-libcurl removes the problem ... but most packagers are under
> > very heavy pressure to enable all features of a package.

And this feature is kind of only useful if it's available anywhere. If
only half of your clients are able to use SSO, you'd probably stick
with passwords anyway. So it needs to be enabled by default.

> How about we provide the current libpq.so without linking to curl and also a
> libpq-oauth.so that has curl support? If we do it right libpq-oauth.so would
> itself link to libpq.so, making libpq-oauth.so a fairly small library.
> 
> That way packagers can split libpq-oauth.so into a separate package, while
> still just building once.

That's definitely a good plan. The blast radius of build dependencies
isn't really a problem, the install/run-time is.

Perhaps we could do the same with libldap and libgssapi? (Though
admittedly I have never seen any complaints or nagging questions from
security people about these.)

Christoph