database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-07 00:04:31 +03:00
Code Activity

MDEV-11340 Allow multiple alternative authentication methods for the same user

Browse Source 
introduce the syntax

... IDENTIFIED { WITH | VIA }
      plugin [ { USING | AS } auth ]
 [ OR plugin [ { USING | AS } auth ]
 [ OR ... ]]

Server will try auth plugins in the specified order until the first
success. No protocol changes, server uses the existing "switch plugin"
packet.

The auth chain is stored in json as

  "auth_or":[{"plugin":"xxx","authentication_string":"yyy"},
             {},
             {"plugin":"foo","authentication_string":"bar"},
            ...],
  "plugin":"aaa", "authentication_string":"bbb"

Note:
* "auth_or" implies that there might be "auth_and" someday;
* one entry in the array is an empty object, meaning to take plugin/auth
  from the main json object. This preserves compatibility with
  the existing mysql.global_priv table and with the mysql.user view.
  This entry is preferrably a mysql_native_password plugin for a
  non-empty mysql.user.password column.

SET PASSWORD is supported and changes the password for the *first*
plugin in the chain that has a notion of a "password"
This commit is contained in:
Sergei Golubchik
2019-01-10 13:51:51 +01:00
parent 798d1a9ddf
commit 5b15cc613e
12 changed files with 1061 additions and 419 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
plugin/auth_gssapi/mysql-test/auth_gssapi/multiauth.result Normal file
View File

@@ -0,0 +1,34 @@
INSTALL SONAME 'auth_gssapi';
Warnings:
Note 1105 SSPI: using principal name 'localhost', mech 'Negotiate'
CREATE USER 'nosuchuser' IDENTIFIED WITH gssapi OR mysql_native_password as password("good");
connect(localhost,nosuchuser,,test,MASTER_MYPORT,MASTER_MYSOCK);
connect con1,localhost,nosuchuser,,;
ERROR 28000: Access denied for user 'nosuchuser'@'localhost' (using password: NO)
connect con1,localhost,nosuchuser,good,;
SELECT USER(),CURRENT_USER();
USER() CURRENT_USER()
nosuchuser@localhost nosuchuser@%
disconnect con1;
connection default;
DROP USER nosuchuser;
CREATE USER 'nosuchuser' IDENTIFIED WITH mysql_native_password as password("good") OR gssapi;
connect(localhost,nosuchuser,,test,MASTER_MYPORT,MASTER_MYSOCK);
connect con1,localhost,nosuchuser,,;
ERROR 28000: GSSAPI name mismatch, requested 'nosuchuser', actual name 'GSSAPI_SHORTNAME'
connect con1,localhost,nosuchuser,good,;
SELECT USER(),CURRENT_USER();
USER() CURRENT_USER()
nosuchuser@localhost nosuchuser@%
disconnect con1;
connection default;
DROP USER nosuchuser;
CREATE USER 'GSSAPI_SHORTNAME' IDENTIFIED WITH mysql_native_password as password("good") OR gssapi;
connect con1,localhost,$GSSAPI_SHORTNAME,,;
SELECT USER(),CURRENT_USER();
USER() CURRENT_USER()
GSSAPI_SHORTNAME@localhost GSSAPI_SHORTNAME@%
disconnect con1;
connection default;
DROP USER 'GSSAPI_SHORTNAME';
UNINSTALL SONAME 'auth_gssapi';

36
plugin/auth_gssapi/mysql-test/auth_gssapi/multiauth.test Normal file
View File

@@ -0,0 +1,36 @@
--replace_regex /name '[^']+'/name 'localhost'/
INSTALL SONAME 'auth_gssapi';
# gssapi,password
CREATE USER 'nosuchuser' IDENTIFIED WITH gssapi OR mysql_native_password as password("good");
replace_result $MASTER_MYSOCK MASTER_MYSOCK $MASTER_MYPORT MASTER_MYPORT;
error ER_ACCESS_DENIED_ERROR;
connect (con1,localhost,nosuchuser,,);
connect (con1,localhost,nosuchuser,good,);
SELECT USER(),CURRENT_USER();
disconnect con1;
connection default;
DROP USER nosuchuser;
# password,gssapi
CREATE USER 'nosuchuser' IDENTIFIED WITH mysql_native_password as password("good") OR gssapi;
replace_result $MASTER_MYSOCK MASTER_MYSOCK $MASTER_MYPORT MASTER_MYPORT $GSSAPI_SHORTNAME GSSAPI_SHORTNAME;
error ER_ACCESS_DENIED_ERROR;
connect (con1,localhost,nosuchuser,,);
connect (con1,localhost,nosuchuser,good,);
SELECT USER(),CURRENT_USER();
disconnect con1;
connection default;
DROP USER nosuchuser;
replace_result $GSSAPI_SHORTNAME GSSAPI_SHORTNAME;
eval CREATE USER '$GSSAPI_SHORTNAME' IDENTIFIED WITH mysql_native_password as password("good") OR gssapi;
connect (con1,localhost,$GSSAPI_SHORTNAME,,);
replace_result $GSSAPI_SHORTNAME GSSAPI_SHORTNAME;
SELECT USER(),CURRENT_USER();
disconnect con1;
connection default;
replace_result $GSSAPI_SHORTNAME GSSAPI_SHORTNAME;
eval DROP USER '$GSSAPI_SHORTNAME';
UNINSTALL SONAME 'auth_gssapi';