Repository navigation
feat: identity-aware AuthSource with delegated password verification - #474
Merged
Merged
Conversation
…ooks AuthSource gains an identity type parameter (default ()): - verify_password(login, presented): delegates password verification to the source and returns the authenticated identity; the default implementation compares against get_password - get_scram_secret returns the identity alongside the credential - authorize(login, identity): runs after successful verification, before the handshake completes (default: allow) The cleartext and SCRAM mechanisms call these hooks and report the identity through AuthOutcome::Completed, so deployments whose user store verifies passwords itself and resolves principals (hashed storage, bearer tokens) no longer need custom mechanisms for verification, identity capture or authorization.
Authorization policy does not belong on the authentication source; deployments that need post-verification authorization can run it in their startup handler on AuthOutcome::Completed (sending an ErrorResponse and closing on failure), or wrap the mechanism when the rejection must precede AuthenticationOk.
sunng87
changed the title
sunng87
force-pushed
the
feat/authsource-identity
branch
from
October 18, 2026 14:31
383dc44 to
ad27451
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #473, motivated by the GreptimeDB adoption: their custom
auth mechanisms (
PgCleartextMechanism+PasswordVerifier) existedonly because
AuthSourcecould fetch passwords for comparisonwhile their user store verifies (hashed storage, bearer tokens) and
resolves the principal.
Changes
AuthSource<I = ()>— identity type parameter, defaulting to()soexisting implementations are unchanged:
verify_password(login, presented_password) -> PgWireResult<Option<I>>— delegates verification to the sourceand returns the authenticated identity. Default: compare against
get_password, report no identity — so password-store sources keeptheir one-method implementations.
get_scram_secretreturns(ScramSecret, Option<I>)— theidentity resolved alongside the credential (e.g. the user a
verifier belongs to;
Nonefor mock verifiers of unknown users).The built-in cleartext and SCRAM mechanisms call these and report the
identity through
AuthOutcome::Completed, statically typed via themechanism identity parameter from #473.
ScramAuth<I>constructionand the cleartext factory are generic accordingly.
For GreptimeDB this reduces to one
AuthSource<UserInfoRef>implementation wrapping their user provider (
verify_password/get_scram_secretmap 1:1 toauthenticate_password/postgres_auth_info), the built-in mechanisms, and a handler matchingAuthOutcome::Completed(Some(user)).Authorization is deliberately not part of this API: policy does not
belong on the authentication source. Run it in the startup handler on
AuthOutcome::Completed(send anErrorResponseand close onfailure), or wrap the mechanism when the rejection must precede
AuthenticationOk.Tests
verify_password-returning source →Completed(Some(identity))Completed(Some(identity))verify_passwordcomparison path covered by existingcleartext tests
Design notes
The identity is carried as
Option<I>rather than bareIbecausethe default method implementations (comparison-based verification,
salted-password derivation) verify successfully without resolving a
principal — there is no
Ithey could return. Sources withconditional identity resolution (mock verifiers for unknown users)
report
Nonealongside a real credential.