Does Azure PostgresSQL flexible server (Postgres 18) support OAuth2 authentication?

Question

Does Azure PostgresSQL flexible server (Postgres 18) support OAuth2 authentication?

Dutsadi Bunliang 0

Hi, we are looking for a way to make our Azure PostgresSQL flexible server to allow token-based authentication via Postgres’s native OAuth authentication (https://www.postgresql.org/docs/current/auth-oauth.html).

In the Azure Portal for our Azure PostgresSQL flexible server, we can set the server parameter pg_oidc_validator value to “pg_oidc_validator” but cannot add new entry to the pg_hba server parameter to define our OAuth issuer URL (https://github.com/percona/pg_oidc_validator).

Do we have a way add a new entry to the pg_hba.conf as not all of our user organizations uses Entra Id?

Hemant Bharadwaj 370 Reputation points Microsoft Employee

2026-11-14T15:59:52.5466667+00:00
PostgreSQL 18 has native OAuth protocol support, but it still needs an OAuth-capable pg_hba.conf rule and a validator library. Azure Database for PostgreSQL Flexible Server is managed: Microsoft documents that it exposes only a subset of PostgreSQL parameters and that some settings requiring superuser access can't be changed. The published PostgreSQL 18 extension list also does not include pg_oidc_validator, so setting a parameter to that name alone doesn't confirm the validator is supported or installed.

Check the PostgreSQL 18 supported extensions and the Flexible Server parameter documentation for the exact server version. If the validator or required OAuth settings aren't exposed there, you can't add the missing HBA rule or install a custom library on Flexible Server yourself; ask Azure support to confirm whether this scenario is supported.

If the requirement is specifically Microsoft Entra ID, compare it with Entra authentication for Flexible Server. That is a separate supported authentication path and doesn't establish support for arbitrary OIDC issuers.

If non-Entra identity providers are mandatory, evaluate an application-side identity broker or a PostgreSQL deployment where you control the server configuration; validate the security and operational impact before choosing either route.

The Flexible Server server concepts page describes these managed-service limits. If you can share which PG18 parameters and extensions are actually available on your server (without credentials or tokens), that can narrow down the supported path.

If you find this answer helpful, please upvote it. If this resolves your issue, please mark it as the accepted answer so that it can help others in the community.

Answer accepted by question author

0 additional answers

Your answer

Hemant Bharadwaj 370 Reputation points Microsoft Employee

2026-11-14T15:59:52.5466667+00:00

PostgreSQL 18 has native OAuth protocol support, but it still needs an OAuth-capable pg_hba.conf rule and a validator library. Azure Database for PostgreSQL Flexible Server is managed: Microsoft documents that it exposes only a subset of PostgreSQL parameters and that some settings requiring superuser access can't be changed. The published PostgreSQL 18 extension list also does not include pg_oidc_validator, so setting a parameter to that name alone doesn't confirm the validator is supported or installed.

Check the PostgreSQL 18 supported extensions and the Flexible Server parameter documentation for the exact server version. If the validator or required OAuth settings aren't exposed there, you can't add the missing HBA rule or install a custom library on Flexible Server yourself; ask Azure support to confirm whether this scenario is supported.

If the requirement is specifically Microsoft Entra ID, compare it with Entra authentication for Flexible Server. That is a separate supported authentication path and doesn't establish support for arbitrary OIDC issuers.

If non-Entra identity providers are mandatory, evaluate an application-side identity broker or a PostgreSQL deployment where you control the server configuration; validate the security and operational impact before choosing either route.

The Flexible Server server concepts page describes these managed-service limits. If you can share which PG18 parameters and extensions are actually available on your server (without credentials or tokens), that can narrow down the supported path.

If you find this answer helpful, please upvote it. If this resolves your issue, please mark it as the accepted answer so that it can help others in the community.

Answer 1

Hi @Dutsadi Bunliang - welcome to the Microsoft Azure QnA.

Adding the specific documentation behind each of the points already raised here.

pg_oidc_validator is not available. It does not appear on the list of extensions Flexible Server supports, so setting the parameter does not install it.

pg_hba.conf is not editable. From Server parameters: “Because Azure Database for PostgreSQL is a managed database service, you don’t have host or operating system access to view or modify configuration files such as postgresql.conf.” pg_hba does not appear anywhere on that page, so there is no parameter for it either.

The supported methods are a closed list, not just an absence of documentation. From Microsoft Entra authentication: “Azure Database for PostgreSQL supports three modes of authentication: PostgreSQL authentication only, Microsoft Entra authentication only, and both PostgreSQL and Microsoft Entra authentication.” An OIDC provider outside Entra is not among them.

So for your users who are not in Entra ID, that leaves local PostgreSQL usernames and passwords, or representing those users in your Entra tenant. Since the supported set is enumerated, I would not plan around an external issuer arriving.

If this helps resolve your question, please accept the answer or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.

Dutsadi Bunliang 0 Reputation points

2026-11-14T17:04:31.2033333+00:00

Yes, this leaves us with either adding none Entra ID user as part of a new Entra tenant to then have a proxy that can request those local Entra ID accounts access token to connect to the database or going with a password-based connection.

Thanks so much for the fast response. Hemant Bharadwaj and SHOUMIK CHAKRAVARTY