database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-01-06 05:22:24 +03:00
Code Activity

MDEV-12321 authentication plugin: SET PASSWORD support

Browse Source 
Support SET PASSWORD for authentication plugins.

Authentication plugin API is extended with two optional methods:
* hash_password() is used to compute a password hash (or digest)
  from the plain-text password. This digest will be stored in mysql.user
  table
* preprocess_hash() is used to convert this digest into some memory
  representation that can be later used to authenticate a user.
  Build-in plugins convert the hash from hexadecimal or base64 to binary,
  to avoid doing it on every authentication attempt.

Note a change in behavior: when loading privileges (on startup or on
FLUSH PRIVILEGES) an account with an unknown plugin was loaded with a
warning (e.g. "Plugin 'foo' is not loaded"). But such an account could
not be used for authentication until the plugin is installed. Now an
account like that will not be loaded at all (with a warning, still).
Indeed, without plugin's preprocess_hash() method the server cannot know
how to load an account. Thus, if a new authentication plugin is
installed run-time, one might need FLUSH PRIVILEGES to activate all
existing accounts that were using this new plugin.
This commit is contained in:
Sergei Golubchik
2018-10-17 12:48:13 +02:00
parent 14e181a434
commit 7c40996cc8
37 changed files with 711 additions and 478 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
mysql-test/suite/plugins/r/auth_ed25519.result
View File

@@ -22,10 +22,10 @@ ed25519_password(NULL)
NULL
select * from information_schema.plugins where plugin_name='ed25519';
PLUGIN_NAME ed25519
PLUGIN_VERSION 1.0
PLUGIN_VERSION 1.1
PLUGIN_STATUS ACTIVE
PLUGIN_TYPE AUTHENTICATION
PLUGIN_TYPE_VERSION 2.1
PLUGIN_TYPE_VERSION 2.2
PLUGIN_LIBRARY auth_ed25519.so
PLUGIN_LIBRARY_VERSION 1.13
PLUGIN_AUTHOR Sergei Golubchik
@@ -33,11 +33,30 @@ PLUGIN_DESCRIPTION Elliptic curve ED25519 based authentication
PLUGIN_LICENSE GPL
LOAD_OPTION ON
PLUGIN_MATURITY Stable
PLUGIN_AUTH_VERSION 1.0
PLUGIN_AUTH_VERSION 1.1
create user test1@localhost identified via ed25519 using 'ZIgUREUg5PVgQ6LskhXmO+eZLS0nC8be6HPjYWR4YJY';
show grants for test1@localhost;
Grants for test1@localhost
GRANT USAGE ON *.* TO 'test1'@'localhost' IDENTIFIED VIA ed25519 USING 'ZIgUREUg5PVgQ6LskhXmO+eZLS0nC8be6HPjYWR4YJY'
drop user test1@localhost;
create user test1@localhost identified via ed25519 using password('foo');
show grants for test1@localhost;
Grants for test1@localhost
GRANT USAGE ON *.* TO 'test1'@'localhost' IDENTIFIED VIA ed25519 USING 'vubFBzIrapbfHct1/J72dnUryz5VS7lA6XHH8sIx4TI'
select ed25519_password('foo');
ed25519_password('foo')
vubFBzIrapbfHct1/J72dnUryz5VS7lA6XHH8sIx4TI
set password for test1@localhost = password('bar');
show create user test1@localhost;
CREATE USER for test1@localhost
CREATE USER 'test1'@'localhost' IDENTIFIED VIA ed25519 USING 'pfzkeWMzkTefY1oshXS+/kATeN51M+4jxi3/cbyTd10'
select ed25519_password('bar');
ed25519_password('bar')
pfzkeWMzkTefY1oshXS+/kATeN51M+4jxi3/cbyTd10
set password for test1@localhost = 'ZIgUREUg5PVgQ6LskhXmO+eZLS0nC8be6HPjYWR4YJY';
show create user test1@localhost;
CREATE USER for test1@localhost
CREATE USER 'test1'@'localhost' IDENTIFIED VIA ed25519 USING 'ZIgUREUg5PVgQ6LskhXmO+eZLS0nC8be6HPjYWR4YJY'
connect(localhost,test1,public,test,PORT,SOCKET);
connect con1, localhost, test1, public;
ERROR 28000: Access denied for user 'test1'@'localhost' (using password: YES)

1
mysql-test/suite/plugins/r/simple_password_check.result
View File

@@ -157,6 +157,7 @@ set global strict_password_validation=1;
drop user foo1;
create role r1;
drop role r1;
flush privileges;
uninstall plugin simple_password_check;
create user foo1 identified by 'pwd';
drop user foo1;