You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Is there any restriction on JS implementation? #243
PostgreSQL's trusted languages can't make network calls so plv8 and trusted plrust can't be used to make the HTTPS requests. It you are running PostgreSQL where you have full superuser rights and can use an untrusted language, plpython could work.
+1 to what @jim-mlodgenski said. However, depending on your environment with a trusted language, you may be able to make a network call with alternative means. For example, you can invoke an AWS Lambda function from an Aurora/RDS function written in a trusted language, where the Lambda function makes the remote network call. It is an extra hop, but it does allow for making HTTPS requests.
Thanks @jim-mlodgenski and @jkatz for the feedback. I'll look for alternatives. Not sure if invoking a Lambda will fit because I should call it from the clientauth hook.
@mxmauro Keep in mind that the ClientAuthentication hook fires after PostgreSQL has authenticated against one of its existing methods (see: https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=src/backend/libpq/auth.c#l232). You can't change the authentication status at that time. There have been proposals upstream to allow for more flexibility in defining how a client authenticates to PostgreSQL, but currently this is not supported.
You would need to configure your own PAM auth module, but you can pass the username/password combination to your own custom module to do the authentication.
Yes but my original intention was to see how far AWS RDS for Postgresql can be extended. At it only supports a few extensions and, for auth, just regular user/pass, IAM roles or Kerberos through AD. Then I found pg_tle for "custom" stuff.
Activity
jim-mlodgenski commentedon Nov 12, 2023
PostgreSQL's trusted languages can't make network calls so plv8 and trusted plrust can't be used to make the HTTPS requests. It you are running PostgreSQL where you have full superuser rights and can use an untrusted language, plpython could work.
jkatz commentedon Nov 12, 2023
+1 to what @jim-mlodgenski said. However, depending on your environment with a trusted language, you may be able to make a network call with alternative means. For example, you can invoke an AWS Lambda function from an Aurora/RDS function written in a trusted language, where the Lambda function makes the remote network call. It is an extra hop, but it does allow for making HTTPS requests.
mxmauro commentedon Nov 12, 2023
Thanks @jim-mlodgenski and @jkatz for the feedback. I'll look for alternatives. Not sure if invoking a Lambda will fit because I should call it from the clientauth hook.
jkatz commentedon Nov 14, 2023
@mxmauro Keep in mind that the ClientAuthentication hook fires after PostgreSQL has authenticated against one of its existing methods (see: https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=src/backend/libpq/auth.c#l232). You can't change the authentication status at that time. There have been proposals upstream to allow for more flexibility in defining how a client authenticates to PostgreSQL, but currently this is not supported.
mxmauro commentedon Nov 14, 2023
I thought you can write an extension to define a new authentication method. I'll go backwards a few steps :) Thanks for the feedback.
JohnHVancouver commentedon Nov 14, 2023
If I understand your ask correctly, this is supported by Postgres generally.
https://www.postgresql.org/docs/current/auth-pam.html
You would need to configure your own PAM auth module, but you can pass the username/password combination to your own custom module to do the authentication.
mxmauro commentedon Nov 15, 2023
Yes but my original intention was to see how far AWS RDS for Postgresql can be extended. At it only supports a few extensions and, for auth, just regular user/pass, IAM roles or Kerberos through AD. Then I found
pg_tlefor "custom" stuff.