Introduce a plugin manager interface to allow different mechanisms to acquire a password.

README.md

@@ -139,6 +139,7 @@ In addition to the standard connection parameters the driver supports a number o
 | adaptiveFetchMaximum          | Integer | -1      | Specifies maximum number of rows, which can be calculated by adaptiveFetch. Number of rows used by adaptiveFetch cannot go above this value. Any negative number set as adaptiveFetchMaximum is used by adaptiveFetch as infinity number of rows.
 | localSocketAddress            | String  | null    | Hostname or IP address given to explicitly configure the interface that the driver will bind the client side of the TCP/IP connection to when connecting.
 | quoteReturningIdentifiers     | Boolean | true    | By default we double quote returning identifiers. Some ORM's already quote them. Switch allows them to turn this off
+| authenticationPluginClassName | STRING  | null    | fully qualified class name of the class implementing the AuthenticationPlugin interface. If this is null, the default PasswordAuthentication plugin will be used
 
 ## Contributing
 For information on how to contribute to the project see the [Contributing Guidelines](CONTRIBUTING.md)

pgjdbc/src/main/java/org/postgresql/PGProperty.java

@@ -82,6 +82,16 @@ public enum PGProperty {
       null,
       "Assume the server is at least that version"),
 
+  /**
+   * AuthenticationPluginClass
+   */
+
+  AUTHENTICATION_PLUGIN_CLASS_NAME(
+      "authenticationPluginClassName",
+      null,
+      "Name of class which implements AuthenticationPlugin"
+  ),
+
   /**
    * Specifies what the driver should do if a query fails. In {@code autosave=always} mode, JDBC driver sets a savepoint before each query,
    * and rolls back to that savepoint in case of failure. In {@code autosave=never} mode (default), no savepoint dance is made ever.

pgjdbc/src/main/java/org/postgresql/core/AuthenticationPlugin.java

@@ -0,0 +1,10 @@
+/*
+ * Copyright (c) 2021, PostgreSQL Global Development Group
+ * See the LICENSE file in the project root for more information.
+ */
+
+package org.postgresql.core;
+
+public interface AuthenticationPlugin {
+  byte[] getEncodedPassword(String userName, String password);
+}

pgjdbc/src/main/java/org/postgresql/core/AuthenticationPluginManager.java

@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2021, PostgreSQL Global Development Group
+ * See the LICENSE file in the project root for more information.
+ */
+
+package org.postgresql.core;
+
+import org.postgresql.PGProperty;
+
+import java.util.Properties;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+public class AuthenticationPluginManager {
+
+  private static final Logger LOGGER = Logger.getLogger(AuthenticationPluginManager.class.getName());
+
+  public static AuthenticationPlugin getAuthenticationPlugin(Properties info) throws Exception {
+    String authenticationClassName = PGProperty.AUTHENTICATION_PLUGIN_CLASS_NAME.getSetString(info);
+
+    if ( authenticationClassName == null ) {
+      return new PasswordAuthentication();
+    } else {
+      try {
+        return (AuthenticationPlugin) Class.forName(authenticationClassName).getDeclaredConstructor().newInstance();
+      } catch (Exception ex ) {
+        LOGGER.log(Level.FINE, "Unable to load Authentication Plugin" + ex.getMessage() );
+        throw ex;
+      }
+    }
+  }
+}

pgjdbc/src/main/java/org/postgresql/core/PasswordAuthentication.java

@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2021, PostgreSQL Global Development Group
+ * See the LICENSE file in the project root for more information.
+ */
+
+package org.postgresql.core;
+
+import java.nio.charset.StandardCharsets;
+
+public class PasswordAuthentication implements AuthenticationPlugin {
+
+  @Override
+  public byte[] getEncodedPassword(String userName, String password) {
+    return password.getBytes(StandardCharsets.UTF_8);
+  }
+}

pgjdbc/src/main/java/org/postgresql/core/v3/ConnectionFactoryImpl.java

@@ -9,6 +9,8 @@
 import static org.postgresql.util.internal.Nullness.castNonNull;
 
 import org.postgresql.PGProperty;
+import org.postgresql.core.AuthenticationPlugin;
+import org.postgresql.core.AuthenticationPluginManager;
 import org.postgresql.core.ConnectionFactory;
 import org.postgresql.core.PGStream;
 import org.postgresql.core.QueryExecutor;
@@ -95,6 +97,7 @@ private PGStream tryConnect(String user, String database,
       Properties info, SocketFactory socketFactory, HostSpec hostSpec,
       SslMode sslMode, GSSEncMode gssEncMode)
       throws SQLException, IOException {
+
     int connectTimeout = PGProperty.CONNECT_TIMEOUT.getInt(info) * 1000;
 
     PGStream newStream = new PGStream(socketFactory, hostSpec, connectTimeout);
@@ -595,6 +598,13 @@ private void doAuthentication(PGStream pgStream, String host, String user, Prope
     // Now get the response from the backend, either an error message
     // or an authentication request
 
+    AuthenticationPlugin authenticationPlugin;
+    try {
+      authenticationPlugin = AuthenticationPluginManager.getAuthenticationPlugin(info);
+    } catch ( Exception ex ) {
+      throw new PSQLException(ex.getMessage(), PSQLState.UNEXPECTED_ERROR);
+    }
+
     String password = PGProperty.PASSWORD.get(info);
 
     /* SSPI negotiation state, if used */
@@ -672,7 +682,7 @@ private void doAuthentication(PGStream pgStream, String host, String user, Prope
                       PSQLState.CONNECTION_REJECTED);
                 }
 
-                byte[] encodedPassword = password.getBytes(StandardCharsets.UTF_8);
+                byte[] encodedPassword = authenticationPlugin.getEncodedPassword(user, password);
 
                 pgStream.sendChar('p');
                 pgStream.sendInteger4(4 + encodedPassword.length + 1);

pgjdbc/src/main/java/org/postgresql/ds/common/BaseDataSource.java

@@ -1305,6 +1305,26 @@ public void setURL(String url) {
     setUrl(url);
   }
 
+  /**
+   *
+   * @return the class name to use for the Authentication Plugin.
+   *         This can be null in which case the default password authentication plugin will be used
+   */
+  public @Nullable String getAuthenticationPluginClassName() {
+    return PGProperty.AUTHENTICATION_PLUGIN_CLASS_NAME.get(properties);
+  }
+
+  /**
+   *
+   * @param className name of a class which implements {@link org.postgresql.core.AuthenticationPlugin}
+   *                  This class will be used to get the encoded bytes to be sent to the server as the
+   *                  password to authenticate the user.
+   *
+   */
+  public void setAuthenticationPluginClassName(String className) {
+    PGProperty.AUTHENTICATION_PLUGIN_CLASS_NAME.set(properties, className);
+  }
+
   public @Nullable String getProperty(String name) throws SQLException {
     PGProperty pgProperty = PGProperty.forName(name);
     if (pgProperty != null) {