*** a/src/backend/libpq/auth.c
--- b/src/backend/libpq/auth.c
***************
*** 39,44 ****
--- 39,46 ----
  #include "replication/walsender.h"
  #include "storage/ipc.h"
  
+ /* Hooks for plugins to get control in ClientAuthentication */
+ client_authentication_hook_type client_authentication_hook = NULL;
  
  /*----------------------------------------------------------------
   * Global authentication functions
***************
*** 582,587 **** ClientAuthentication(Port *port)
--- 584,601 ----
  	else
  		auth_failed(port, status);
  
+ 	/*
+ 	 * client_authentication_hook
+ 	 *
+ 	 * If available, this hook allows an external security provider to
+ 	 * get control just after client authentication. In genaral, it can
+ 	 * be used to assign additional properties to identify the client,
+ 	 * such as security label, based on the authenticated username or
+ 	 * other properties of the Port.
+ 	 */
+ 	if (client_authentication_hook)
+ 		(*client_authentication_hook)(port);
+ 
  	/* Done with authentication, so we should turn off immediate interrupts */
  	ImmediateInterruptOK = false;
  }
*** a/src/include/libpq/libpq.h
--- b/src/include/libpq/libpq.h
***************
*** 41,46 **** typedef struct
--- 41,50 ----
   * External functions.
   */
  
+ /* Hook for plugins to get control on ClientAuthentication() */
+ typedef void (*client_authentication_hook_type)(Port *);
+ extern PGDLLIMPORT client_authentication_hook_type client_authentication_hook;
+ 
  /*
   * prototypes for functions in pqcomm.c
   */