SQL-76 Add pgwire password authentication to OIDC authenticator by SangJunBak · Pull Request #34801 · MaterializeInc/materialize

SangJunBak · 2026-01-22T22:43:48Z

see commit messages for details, starting from commit "Add password fallback for OIDC pgwire". Commits before are. being reviewed in #34690.

Will do http pgwire password authentication in a followup PR.

Motivation

Tips for reviewer

Checklist

This PR has adequate test coverage / QA involvement has been duly considered. (trigger-ci for additional test/nightly runs)
This PR has an associated up-to-date design doc, is a design doc (template), or is sufficiently small to not require a design.
If this PR evolves an existing $T ⇔ Proto$T mapping (possibly in a backwards-incompatible way), then it is tagged with a T-proto label.
If this PR will require changes to cloud orchestration or tests, there is a companion cloud PR to account for those changes that is tagged with the release-blocker label (example).
If this PR includes major user-facing behavior changes, I have pinged the relevant PM to schedule a changelog post.

- Add external_metadata_rx() method to OidcAuthSessionHandle trait with default None impl This allows us to create a helper functions for anything implementing OidcAuthenticator. - Update Authenticator::Oidc to use named fields: {oidc, password}

- Add authenticate_with_oidc_token for token-based auth (Frontegg/OIDC JWT) - Add authenticate_with_password for password-based auth

- Enables tests to pass connection-level options like --oidc_auth_enabled - Verifies that when oidc_auth_enabled is not set in the connection options, the OIDC authenticator falls back to password authentication.

Call stacks above the critical recursion can grow as we add code elsewhere in the system

teskje

Looks fine to me.

I'm a bit unhappy with adding password auth as a special case for OIDC auth, ideally we would leave the concerns separated and leave the password auth to the password authenticator. Would it be difficult to move the dispatching on the auth method one level up and just use the password authenticator when OIDC is disabled via the option?

teskje · 2026-02-09T22:33:23Z

-    Oidc(GenericOidcAuthenticator),
+    Oidc {
+        oidc: GenericOidcAuthenticator,
+        password: AdapterClient,


Maybe call this adapter_client? I think you name it password because it's used for password auth, but I was confused initially thinking this field stores a password instead.

Good call! Implemented it in my latest commit.

teskje · 2026-02-09T22:45:38Z

 # the query planner and optimizer.

-# 475 UNIONs
+# 418 UNIONs


teskje

Looks good to me, just a couple minor comments.

teskje · 2026-02-17T16:18:28Z

-        // We can only send the Frontegg, OIDC, and None variants immediately.
-        // The Password variant requires an adapter client.
+        // We can only send the Frontegg and None variants immediately.
+        // The Password and Oidc variants require an adapter client.


Oidc doesn't require an adapter client anymore, right?

teskje · 2026-02-17T16:22:52Z

+    frontegg: Option<FronteggAuthenticator>,
+    oidc: Option<GenericOidcAuthenticator>,
+    adapter_client: mz_adapter::Client,
+    // If oidc_auth_enabled exists as an option in the connection options,


Looks like this comment got cut off?

teskje · 2026-02-17T16:25:24Z

+        AuthenticatorKind::Password => Authenticator::Password(adapter_client),
+        AuthenticatorKind::Sasl => Authenticator::Sasl(adapter_client),
+        AuthenticatorKind::Oidc => {
+            let oidc = oidc.expect("OIDC authenticator should exist with AuthenticatorKind::Oidc");


Nit: Move this into the if branch, closer to its usage.

By choosing the authenticator on connection, we can keep password authentication tied to AuthenticatorKind::Password. We need to do it on connection because it depends on the oidc_auth_enabled value from 'options' in the connection parameters

…rializeInc#34801)  see commit messages for details, starting from commit "[Add password fallback for OIDC pgwire](MaterializeInc@e3bbf7a)". Commits before are. being reviewed in MaterializeInc#34690. Will do http pgwire password authentication in a followup PR. ### Motivation  ### Tips for reviewer  ### Checklist - [ ] This PR has adequate test coverage / QA involvement has been duly considered. ([trigger-ci for additional test/nightly runs](https://trigger-ci.dev.materialize.com/)) - [ ] This PR has an associated up-to-date [design doc](https://github.com/MaterializeInc/materialize/blob/main/doc/developer/design/README.md), is a design doc ([template](https://github.com/MaterializeInc/materialize/blob/main/doc/developer/design/00000000_template.md)), or is sufficiently small to not require a design.  - [ ] If this PR evolves [an existing `$T ⇔ Proto$T` mapping](https://github.com/MaterializeInc/materialize/blob/main/doc/developer/command-and-response-binary-encoding.md) (possibly in a backwards-incompatible way), then it is tagged with a `T-proto` label. - [ ] If this PR will require changes to cloud orchestration or tests, there is a companion cloud PR to account for those changes that is tagged with the release-blocker label ([example](MaterializeInc/cloud#5021)).  - [ ] If this PR includes major [user-facing behavior changes](https://github.com/MaterializeInc/materialize/blob/main/doc/developer/guide-changes.md#what-changes-require-a-release-note), I have pinged the relevant PM to schedule a changelog post.

SangJunBak force-pushed the jun/add-password-auth-to-oidc branch 7 times, most recently from a8d789b to aed6472 Compare January 27, 2026 19:01

SangJunBak changed the title ~~Jun/add password auth to OIDC~~ SQL-76 Add pgwire password authentication to OIDC authenticator Jan 28, 2026

SangJunBak marked this pull request as ready for review January 28, 2026 03:40

SangJunBak requested review from a team and ggevay as code owners January 28, 2026 03:40

SangJunBak force-pushed the jun/add-password-auth-to-oidc branch from aed6472 to 1ccd67a Compare January 28, 2026 06:56

SangJunBak requested review from a team, aljoscha and teskje as code owners January 28, 2026 06:56

SangJunBak force-pushed the jun/add-password-auth-to-oidc branch from 1ccd67a to 0d5b665 Compare January 28, 2026 07:09

SangJunBak removed request for a team, aljoscha, ggevay and teskje January 28, 2026 14:33

SangJunBak force-pushed the jun/add-password-auth-to-oidc branch from 0d5b665 to c04b2aa Compare January 28, 2026 14:53

SangJunBak requested a review from teskje January 28, 2026 15:43

SangJunBak force-pushed the jun/add-password-auth-to-oidc branch 2 times, most recently from 047394c to 5de9377 Compare February 9, 2026 18:33

SangJunBak force-pushed the jun/add-password-auth-to-oidc branch from 5de9377 to 31359cd Compare February 9, 2026 20:16

SangJunBak added 3 commits February 9, 2026 17:07

Add password fallback for OIDC pgwire

8a10c3b

- Add authenticate_with_oidc_token for token-based auth (Frontegg/OIDC JWT) - Add authenticate_with_password for password-based auth

Add test_auth_oidc_password_fallback test

fe744ef

- Enables tests to pass connection-level options like --oidc_auth_enabled - Verifies that when oidc_auth_enabled is not set in the connection options, the OIDC authenticator falls back to password authentication.

Decrease unions in recursion limit test

b04753d

Call stacks above the critical recursion can grow as we add code elsewhere in the system

SangJunBak force-pushed the jun/add-password-auth-to-oidc branch from 31359cd to b04753d Compare February 9, 2026 22:09

teskje reviewed Feb 9, 2026

View reviewed changes

SangJunBak requested a review from teskje February 13, 2026 19:36

SangJunBak force-pushed the jun/add-password-auth-to-oidc branch from c00c9cb to 7d99ff9 Compare February 13, 2026 20:23

teskje approved these changes Feb 17, 2026

View reviewed changes

adapter: Choose authenticator on connection

531b22e

By choosing the authenticator on connection, we can keep password authentication tied to AuthenticatorKind::Password. We need to do it on connection because it depends on the oidc_auth_enabled value from 'options' in the connection parameters

SangJunBak force-pushed the jun/add-password-auth-to-oidc branch from 7d99ff9 to 531b22e Compare February 18, 2026 04:44

SangJunBak enabled auto-merge (squash) February 18, 2026 04:44

SangJunBak merged commit b47068b into MaterializeInc:main Feb 18, 2026
133 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SQL-76 Add pgwire password authentication to OIDC authenticator#34801

SQL-76 Add pgwire password authentication to OIDC authenticator#34801
SangJunBak merged 5 commits intoMaterializeInc:mainfrom
SangJunBak:jun/add-password-auth-to-oidc

SangJunBak commented Jan 22, 2026 •

edited

Loading

Uh oh!

teskje left a comment

Uh oh!

teskje Feb 9, 2026

Uh oh!

SangJunBak Feb 13, 2026 •

edited

Loading

Uh oh!

teskje Feb 9, 2026

Uh oh!

teskje left a comment •

edited

Loading

Uh oh!

teskje Feb 17, 2026

Uh oh!

teskje Feb 17, 2026

Uh oh!

teskje Feb 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

SangJunBak commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Tips for reviewer

Checklist

Uh oh!

teskje left a comment

Choose a reason for hiding this comment

Uh oh!

teskje Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

SangJunBak Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

teskje Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

teskje left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

teskje Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

teskje Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

teskje Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

SangJunBak commented Jan 22, 2026 •

edited

Loading

SangJunBak Feb 13, 2026 •

edited

Loading

teskje left a comment •

edited

Loading