Add OAuth support to PostgreSQL provider #64404
Open
+273
−44
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR adds support for using OAuth authentication on PostgreSQL connections, as introduced in PostgreSQL 18.
The UI-changes are minimal, just that OAuth is available as an authentication method on PostgreSQL connections.
Given that this is still a very new feature in PostgreSQL, there is still relatively limited information available, and no other in-the-wild client implementations (that I've been able to find) to look at.
Implementation details
The interface provided by libpq is intended to be non-blocking, however I've implemented it as a blocking operation for two reasons:
QgsPostgresConnuses the blocking variant of thePQconnect*function)I haven't found any drawbacks during my testing, though it's of course possible that doing it blocking violates some assumption in libpq that may manifest as a bug later on. I've tried commenting the implementation quite extensively.
For non-
QgsPostgresConn-connections (such as frompsycopgorQSqlDatabase) we fallback to the default flow provided by libpq (which in practice will likely fail, but at least we don't make anything worse for those cases).Testing
I've tested these changes against Zitadel (IdP) and PostgreSQL 18.1 (as well as 17 do confirm that that still works), though any OAuth-compatible IdP should work.
I've used the dummy validator available here: https://github.com/sevensolutions/postgres18-oauth-playground/blob/main/README.md.