feat: add support for Postgres IAM authentication in JDBC and R2DBC connectors#490
feat: add support for Postgres IAM authentication in JDBC and R2DBC connectors#490shubha-rajan merged 15 commits intomainfrom
Conversation
shubha-rajan
force-pushed
the
iam-auth
branch
2 times, most recently
from
a289613 to
d8db5d2
Compare
shubha-rajan
added
kokoro:force-run
core/src/main/java/com/google/cloud/sql/core/CloudSqlInstance.java
Outdated
Show resolved
Hide resolved
| /** | ||
| * Name of system property that can specify an alternative credential factory. | ||
| */ | ||
| String TOKEN_SOURCE_FACTORY_PROPERTY = "cloudSql.socketFactory.TokenSourceFactory"; |
There was a problem hiding this comment.
We already have a credential socket factory right? Can we get a token source from the credentials?
There was a problem hiding this comment.
I guess what I'm saying is we already have a property for setting the user credentials, can we reuse the user credentials instead of trying to ask for the token source from somewhere else?
There was a problem hiding this comment.
So the Credential Factory returns credentials that are wrapped in a HttpCredentialsAdapter and there's no way to get credentials back from that, because they're private https://github.com/googleapis/google-auth-library-java/blob/master/oauth2_http/java/com/google/auth/http/HttpCredentialsAdapter.java#L64
We could change the Credential Factory to return a GoogleCredentials object and then convert that to the HttpCredentialsAdapter later, but I'm hesitant to change the existing interface
There was a problem hiding this comment.
That's a DPE owned library - can we PR a getter so we can have access to it?
There was a problem hiding this comment.
core/src/main/java/com/google/cloud/sql/core/CloudSqlInstance.java
Outdated
Show resolved
Hide resolved
core/src/main/java/com/google/cloud/sql/core/CloudSqlInstance.java
Outdated
Show resolved
Hide resolved
core/src/main/java/com/google/cloud/sql/core/CloudSqlInstance.java
Outdated
Show resolved
Hide resolved
shubha-rajan
force-pushed
the
iam-auth
branch
4 times, most recently
from
4732aa0 to
6f8f197
Compare
shubha-rajan
added
the
kokoro:force-run
kokoro-team
removed
the
kokoro:force-run
…java Co-authored-by: Kurtis Van Gent <[email protected]>
Are there any security implications to disabling sslmode? |
|
@meltsufin No - there are two potential layers of encryption - at the connection level, and at the database protocol level. Disabling at the database level is fine because the connection level is always persistent. |
4 participants
Change Description
Adds IAM Auth support. Some notes to keep in mind:
sslmodeneeds to be disabled or the driver will hang indefinitely.Checklist
bug/issue
before writing your code! That way we can discuss the change, evaluate
designs, and agree on the general idea.
Relevant issues: