Message-ID: <bfc55e8045453659df26cd60035bfbb4b9530052.camel@j-davis.com>
Subject: Re: Proposal: Support custom authentication methods using hooks
From: Jeff Davis <pgsql@j-davis.com>
To: samay sharma <smilingsamay@gmail.com>, pgsql-hackers@lists.postgresql.org
Date: Thu, 24 Feb 2022 17:02:45 -0800
In-Reply-To: <CAJxrbyxTRn5P8J-p+wHLwFahK5y56PhK28VOb55jqMO05Y-DJw@mail.gmail.com>
References: 
	<CAJxrbyxTRn5P8J-p+wHLwFahK5y56PhK28VOb55jqMO05Y-DJw@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Archived-At: <https://www.postgresql.org/message-id/bfc55e8045453659df26cd60035bfbb4b9530052.camel%40j-davis.com>
Precedence: bulk

On Thu, 2022-02-17 at 11:25 -0800, samay sharma wrote:
> To enable this, I've proposed adding a new authentication method
> "custom" which can be specified in pg_hba.conf and takes a mandatory
> argument  "provider" specifying which authentication provider to use.
> I've also moved a couple static functions to headers so that
> extensions can call them.
> 
> Sample pg_hba.conf line to use a custom provider:
> 
> host    all             all             ::1/128              
>   custom provider=test

One caveat is that this only works given information available from
existing authentication methods, because that's all the client
supports. In practice, it seems to only be useful with plaintext
password authentication over an SSL connection.

I still like the approach though. There's a lot of useful stuff you can
do at authentication time with only the connection information and a
password. It could be useful to authenticate against different
services, or some kind of attack detection, etc.

Regards,
	Jeff Davis