Authentification method on client side checking

diff --git a/src/bin/psql/startup.c b/src/bin/psql/startup.c
index 8068a28..1877b2d 100644
--- a/src/bin/psql/startup.c
+++ b/src/bin/psql/startup.c
@@ -75,6 +75,7 @@ struct adhoc_opts
 	bool		no_psqlrc;
 	bool		single_txn;
 	bool		list_dbs;
+	char	   *authtype;
 	SimpleActionList actions;
 };
 
@@ -213,7 +214,7 @@ main(int argc, char *argv[])
 	/* loop until we have a password if requested by backend */
 	do
 	{
-#define PARAMS_ARRAY_SIZE	8
+#define PARAMS_ARRAY_SIZE	9
 		const char **keywords = pg_malloc(PARAMS_ARRAY_SIZE * sizeof(*keywords));
 		const char **values = pg_malloc(PARAMS_ARRAY_SIZE * sizeof(*values));
 
@@ -232,8 +233,10 @@ main(int argc, char *argv[])
 		values[5] = pset.progname;
 		keywords[6] = "client_encoding";
 		values[6] = (pset.notty || getenv("PGCLIENTENCODING")) ? NULL : "auto";
-		keywords[7] = NULL;
-		values[7] = NULL;
+		keywords[7] = "acc_auth";
+		values[7] = options.authtype;
+		keywords[8] = NULL;
+		values[8] = NULL;
 
 		new_pass = false;
 		pset.db = PQconnectdbParams(keywords, values, true);
@@ -441,6 +444,7 @@ parse_psql_options(int argc, char *argv[], struct adhoc_opts * options)
 		{"single-line", no_argument, NULL, 'S'},
 		{"tuples-only", no_argument, NULL, 't'},
 		{"table-attr", required_argument, NULL, 'T'},
+		{"authtype", required_argument, NULL, 'u'},
 		{"username", required_argument, NULL, 'U'},
 		{"set", required_argument, NULL, 'v'},
 		{"variable", required_argument, NULL, 'v'},
@@ -458,7 +462,7 @@ parse_psql_options(int argc, char *argv[], struct adhoc_opts * options)
 
 	memset(options, 0, sizeof *options);
 
-	while ((c = getopt_long(argc, argv, "aAbc:d:eEf:F:h:HlL:no:p:P:qR:sStT:U:v:VwWxXz?01",
+	while ((c = getopt_long(argc, argv, "aAbc:d:eEf:F:h:HlL:no:p:P:qR:sStT:u:U:v:VwWxXz?01",
 							long_options, &optindex)) != -1)
 	{
 		switch (c)
@@ -566,6 +570,9 @@ parse_psql_options(int argc, char *argv[], struct adhoc_opts * options)
 			case 'T':
 				pset.popt.topt.tableAttr = pg_strdup(optarg);
 				break;
+			case 'u':
+				options->authtype = pg_strdup(optarg);
+				break;
 			case 'U':
 				options->username = pg_strdup(optarg);
 				break;
diff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.c
index 4dc8924..b8e77d4 100644
--- a/src/interfaces/libpq/fe-connect.c
+++ b/src/interfaces/libpq/fe-connect.c
@@ -304,6 +304,10 @@ static const internalPQconninfoOption PQconninfoOptions[] = {
 		"Target-Session-Attrs", "", 11, /* sizeof("read-write") = 11 */
 	offsetof(struct pg_conn, target_session_attrs)},
 
+	{"acc_auth", NULL, NULL, NULL,
+		"Acceptable authentification methods", "", 20,
+	offsetof(struct pg_conn, acc_auth)},
+
 	/* Terminating entry --- MUST BE LAST */
 	{NULL, NULL, NULL, NULL,
 	NULL, NULL, 0}
@@ -1000,6 +1004,43 @@ connectOptions2(PGconn *conn)
 		}
 	}
 
+	/* Validate acceptable authentification methods */
+	if (conn->acc_auth)
+	{
+		char * pvalue = conn->acc_auth;
+		char * comma = pvalue;
+		while ((comma = strchr(pvalue, ',')))
+		{
+			*comma = '\0';
+			if (strcmp(pvalue, "password") != 0
+				&& strcmp(pvalue, "md5") != 0
+				&& strcmp(pvalue, "scram") != 0
+				&& strcmp(pvalue, "gss") != 0
+				&& strcmp(pvalue, "sspi") != 0)
+			{
+				conn->status = CONNECTION_BAD;
+				printfPQExpBuffer(&conn->errorMessage,
+							libpq_gettext("invalid authtype value: \"%s\"\n"),
+							  pvalue);
+				return false;
+			}
+			*comma = ',';
+			pvalue = comma + 1;
+		}
+		if (strcmp(pvalue, "password") != 0
+			&& strcmp(pvalue, "md5") != 0
+			&& strcmp(pvalue, "scram") != 0
+			&& strcmp(pvalue, "gss") != 0
+			&& strcmp(pvalue, "sspi") != 0)
+		{
+			conn->status = CONNECTION_BAD;
+			printfPQExpBuffer(&conn->errorMessage,
+						libpq_gettext("invalid authtype value: \"%s\"\n"),
+						  pvalue);
+			return false;
+		}
+	}
+
 	/*
 	 * validate sslmode option
 	 */
@@ -1822,6 +1863,43 @@ restoreErrorMessage(PGconn *conn, PQExpBuffer savedMessage)
 	termPQExpBuffer(savedMessage);
 }
 
+static bool
+isAllowableAuth(int areq, char* acc_auth)
+{
+	/* Allowable authentification scheme is not specified. */
+	if (acc_auth == 0)
+		return true;
+	switch (areq)
+	{
+		case AUTH_REQ_OK:
+			return true;
+		case AUTH_REQ_KRB4:
+			return false; // Since it is not supported anymore
+		case AUTH_REQ_KRB5:
+			return false; // Since it is not supported anymore
+		case AUTH_REQ_PASSWORD:
+			return strstr(acc_auth, "password") != NULL;
+		case AUTH_REQ_CRYPT:
+			return false; // Since it is not supported anymore
+		case AUTH_REQ_MD5:
+			return strstr(acc_auth, "md5") != NULL;
+		case AUTH_REQ_SCM_CREDS:
+			break;
+		case AUTH_REQ_GSS:
+			return strstr(acc_auth, "gss") != NULL;
+		case AUTH_REQ_GSS_CONT:
+			return strstr(acc_auth, "gss") != NULL
+				   || strstr(acc_auth, "sspi") != NULL;
+		case AUTH_REQ_SSPI:
+			return strstr(acc_auth, "sspi") != NULL;
+		case AUTH_REQ_SASL:
+		case AUTH_REQ_SASL_CONT:
+		case AUTH_REQ_SASL_FIN:
+			return strstr(acc_auth, "scram") != NULL;
+	}
+	return true;
+}
+
 /* ----------------
  *		PQconnectPoll
  *
@@ -2680,6 +2758,13 @@ keep_going:						/* We will come back to here until there is
 				}
 				msgLength -= 4;
 
+				/* Check if authentification method is allowedable */
+				if (!isAllowableAuth(areq, conn->acc_auth))
+				{
+					appendPQExpBufferStr(&conn->errorMessage,
+											 libpq_gettext("Authentification scheme is not allowed\n"));
+					goto error_return;
+				}
 				/*
 				 * Ensure the password salt is in the input buffer, if it's an
 				 * MD5 request.  All the other authentication methods that
diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h
index 34d0492..ce55951 100644
--- a/src/interfaces/libpq/libpq-int.h
+++ b/src/interfaces/libpq/libpq-int.h
@@ -488,6 +488,8 @@ struct pg_conn
 								 * connection */
 #endif
 
+	char	   *acc_auth;		/* Acceptable authentification methods */
+
 	/* Buffer for current error message */
 	PQExpBufferData errorMessage;		/* expansible string */