Skip to content

Conversation

@02JanDal
Copy link

Description

This PR adds support for using OAuth authentication on PostgreSQL connections, as introduced in PostgreSQL 18.

The UI-changes are minimal, just that OAuth is available as an authentication method on PostgreSQL connections.

Given that this is still a very new feature in PostgreSQL, there is still relatively limited information available, and no other in-the-wild client implementations (that I've been able to find) to look at.

Implementation details

The interface provided by libpq is intended to be non-blocking, however I've implemented it as a blocking operation for two reasons:

  • QGIS doesn't actually need it to be non-blocking (QgsPostgresConn uses the blocking variant of the PQconnect* function)
  • A non-blocking implementation would have been significantly more complex, and also platform dependent (the built-in flow in libpq/psql has separate implementations for Linux and BSD, and doesn't support Windows)

I haven't found any drawbacks during my testing, though it's of course possible that doing it blocking violates some assumption in libpq that may manifest as a bug later on. I've tried commenting the implementation quite extensively.

For non-QgsPostgresConn-connections (such as from psycopg or QSqlDatabase) we fallback to the default flow provided by libpq (which in practice will likely fail, but at least we don't make anything worse for those cases).

Testing

I've tested these changes against Zitadel (IdP) and PostgreSQL 18.1 (as well as 17 do confirm that that still works), though any OAuth-compatible IdP should work.

I've used the dummy validator available here: https://github.com/sevensolutions/postgres18-oauth-playground/blob/main/README.md.

@github-actions github-actions bot added this to the 4.0.0 milestone Dec 30, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Dec 30, 2025

🪟 Windows Qt6 builds

Download Windows Qt6 builds of this PR for testing.
(Built from commit c9ed610)

🍎 MacOS Qt6 builds

Download MacOS Qt6 builds of this PR for testing.
This installer is not signed, control+click > open the app to avoid the warning
(Built from commit c9ed610)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant