Re: [PoC] Federated Authn/z with OAUTHBEARER

On Tue, Oct 29, 2024 at 1:34 PM Jacob Champion
<jacob(dot)champion(at)enterprisedb(dot)com> wrote:
> Next up will be Antonin's suggested change to the Bearer handling, as
> well as previously-discussed changes to the --with-oauth build option.

Done in v36, attached. The Bearer scheme is enforced in all cases
except initial discovery.

--with-builtin-oauth=curl is now the way to build with the
libcurl-based Device Authorization flow. If you don't want to build
with that option, you can still use the callback hooks for your own
flow. (libpq will give you a new error message if the server requires
OAUTHBEARER but you have no flows installed.) There is also a related
002_client.pl, which provides a basic framework for testing the hooks
without an authorization server. I expect to flesh that out more.

This also means that fe-auth-oauth.c is now always incorporated into
the client build. So I had to fix the SOCKET/int confusion on Windows
in libpq-fe.h: it now has a dependency on <winsock2.h>. I don't really
like that, and if anyone has a way to decouple those safely, I'm all
ears.

Thanks,
--Jacob