mirror of
https://github.com/MariaDB/server.git
synced 2025-07-24 19:42:23 +03:00
5b15cc613e
introduce the syntax
... IDENTIFIED { WITH | VIA }
plugin [ { USING | AS } auth ]
[ OR plugin [ { USING | AS } auth ]
[ OR ... ]]
Server will try auth plugins in the specified order until the first
success. No protocol changes, server uses the existing "switch plugin"
packet.
The auth chain is stored in json as
"auth_or":[{"plugin":"xxx","authentication_string":"yyy"},
{},
{"plugin":"foo","authentication_string":"bar"},
...],
"plugin":"aaa", "authentication_string":"bbb"
Note:
* "auth_or" implies that there might be "auth_and" someday;
* one entry in the array is an empty object, meaning to take plugin/auth
from the main json object. This preserves compatibility with
the existing mysql.global_priv table and with the mysql.user view.
This entry is preferrably a mysql_native_password plugin for a
non-empty mysql.user.password column.
SET PASSWORD is supported and changes the password for the *first*
plugin in the chain that has a notion of a "password"
180 lines
6.3 KiB
Plaintext
180 lines
6.3 KiB
Plaintext
#
|
|
# MDEV-11340 Allow multiple alternative authentication methods for the same user
|
|
#
|
|
--source include/have_unix_socket.inc
|
|
if (`SELECT '$USER' = 'mysqltest1'`) {
|
|
skip USER is mysqltest1;
|
|
}
|
|
if (!$AUTH_ED25519_SO) {
|
|
skip No auth_ed25519 plugin;
|
|
}
|
|
|
|
--let $plugindir=`SELECT @@global.plugin_dir`
|
|
install soname 'auth_socket';
|
|
install soname 'auth_ed25519';
|
|
|
|
--let $try_auth=$MYSQL_TEST < $MYSQLTEST_VARDIR/tmp/peercred_test.txt
|
|
|
|
--write_file $MYSQLTEST_VARDIR/tmp/peercred_test.txt
|
|
--let $replace1=$USER@localhost
|
|
--let $replace2=$USER@%
|
|
--replace_result $replace1 "USER@localhost" $replace2 "USER@%"
|
|
select user(), current_user(), database();
|
|
EOF
|
|
|
|
--let $creplace=create user $USER
|
|
--let $dreplace=drop user $USER
|
|
|
|
#
|
|
# socket,password
|
|
#
|
|
--replace_result $creplace "create user USER"
|
|
eval $creplace identified via unix_socket OR mysql_native_password as password("GOOD");
|
|
create user mysqltest1 identified via unix_socket OR mysql_native_password as password("good");
|
|
show create user mysqltest1;
|
|
--echo # name match = ok
|
|
--exec $try_auth -u $USER
|
|
--echo # name does not match, password good = ok
|
|
--exec $try_auth -u mysqltest1 -pgood
|
|
--echo # name does not match, password bad = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1 -pbad
|
|
--replace_result $dreplace "drop user USER"
|
|
eval $dreplace, mysqltest1;
|
|
|
|
#
|
|
# password,socket
|
|
#
|
|
--replace_result $creplace "create user USER"
|
|
eval $creplace identified via mysql_native_password as password("GOOD") OR unix_socket;
|
|
create user mysqltest1 identified via mysql_native_password as password("good") OR unix_socket;
|
|
show create user mysqltest1;
|
|
--echo # name match = ok
|
|
--exec $try_auth -u $USER
|
|
--echo # name does not match, password good = ok
|
|
--exec $try_auth -u mysqltest1 -pgood
|
|
--echo # name does not match, password bad = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1 -pbad
|
|
--replace_result $dreplace "drop user USER"
|
|
eval $dreplace, mysqltest1;
|
|
|
|
#
|
|
# socket,ed25519
|
|
#
|
|
--replace_result $creplace "create user USER"
|
|
eval $creplace identified via unix_socket OR ed25519 as password("GOOD");
|
|
create user mysqltest1 identified via unix_socket OR ed25519 as password("good");
|
|
show create user mysqltest1;
|
|
--echo # name match = ok
|
|
--exec $try_auth -u $USER
|
|
--echo # name does not match, password good = ok
|
|
--exec $try_auth -u mysqltest1 -pgood
|
|
--echo # name does not match, password bad = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1 -pbad
|
|
--replace_result $dreplace "drop user USER"
|
|
eval $dreplace, mysqltest1;
|
|
|
|
#
|
|
# ed25519,socket
|
|
#
|
|
--replace_result $creplace "create user USER"
|
|
eval $creplace identified via ed25519 as password("GOOD") OR unix_socket;
|
|
create user mysqltest1 identified via ed25519 as password("good") OR unix_socket;
|
|
show create user mysqltest1;
|
|
--echo # name match = ok
|
|
--exec $try_auth -u $USER
|
|
--echo # name does not match, password good = ok
|
|
--exec $try_auth -u mysqltest1 -pgood
|
|
--echo # name does not match, password bad = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1 -pbad
|
|
--replace_result $dreplace "drop user USER"
|
|
eval $dreplace, mysqltest1;
|
|
|
|
#
|
|
# ed25519,socket,password
|
|
#
|
|
--replace_result $creplace "create user USER"
|
|
eval $creplace identified via ed25519 as password("GOOD") OR unix_socket OR mysql_native_password as password("works");
|
|
create user mysqltest1 identified via ed25519 as password("good") OR unix_socket OR mysql_native_password as password("works");
|
|
show create user mysqltest1;
|
|
--echo # name match = ok
|
|
--exec $try_auth -u $USER
|
|
--echo # name does not match, password good = ok
|
|
--exec $try_auth -u mysqltest1 -pgood
|
|
--echo # name does not match, second password works = ok
|
|
--exec $try_auth -u mysqltest1 -pworks
|
|
--echo # name does not match, password bad = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1 -pbad
|
|
--replace_result $dreplace "drop user USER"
|
|
eval $dreplace, mysqltest1;
|
|
|
|
#
|
|
# password,password
|
|
#
|
|
create user mysqltest1 identified via mysql_native_password as password("good") OR mysql_native_password as password("works");
|
|
show create user mysqltest1;
|
|
--echo # password good = ok
|
|
--exec $try_auth -u mysqltest1 -pgood
|
|
--echo # second password works = ok
|
|
--exec $try_auth -u mysqltest1 -pworks
|
|
--echo # password bad = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1 -pbad
|
|
drop user mysqltest1;
|
|
|
|
#
|
|
# show grants, flush privileges, set password, alter user
|
|
#
|
|
create user mysqltest1 identified via ed25519 as password("good") OR unix_socket OR mysql_native_password as password("works");
|
|
show grants for mysqltest1;
|
|
select json_detailed(priv) from mysql.global_priv where user='mysqltest1';
|
|
select password,plugin,authentication_string from mysql.user where user='mysqltest1';
|
|
flush privileges;
|
|
show create user mysqltest1;
|
|
set password for mysqltest1 = password('foobar');
|
|
show create user mysqltest1;
|
|
alter user mysqltest1 identified via unix_socket OR mysql_native_password as password("some");
|
|
show create user mysqltest1;
|
|
set password for mysqltest1 = password('foobar');
|
|
show create user mysqltest1;
|
|
alter user mysqltest1 identified via unix_socket;
|
|
--error ER_SET_PASSWORD_AUTH_PLUGIN
|
|
set password for mysqltest1 = password('bla');
|
|
alter user mysqltest1 identified via mysql_native_password as password("some") or unix_socket;
|
|
show create user mysqltest1;
|
|
drop user mysqltest1;
|
|
|
|
--source include/switch_to_mysql_user.inc
|
|
--replace_regex /\d{6}/XX.YY.ZZ/
|
|
--error ER_COL_COUNT_DOESNT_MATCH_PLEASE_UPDATE
|
|
create user mysqltest1 identified via ed25519 as password("good") OR unix_socket OR mysql_native_password as password("works");
|
|
--source include/switch_to_mysql_global_priv.inc
|
|
|
|
#
|
|
# invalid password,socket
|
|
#
|
|
--replace_result $creplace "create user USER"
|
|
eval $creplace identified via mysql_native_password as '1234567890123456789012345678901234567890a' OR unix_socket;
|
|
create user mysqltest1 identified via mysql_native_password as '1234567890123456789012345678901234567890a' OR unix_socket;
|
|
update mysql.global_priv set priv=replace(priv, '1234567890123456789012345678901234567890a', 'invalid password');
|
|
flush privileges;
|
|
show create user mysqltest1;
|
|
--echo # name match = ok
|
|
--exec $try_auth -u $USER
|
|
--echo # name does not match = failure
|
|
--error 1
|
|
--exec $try_auth -u mysqltest1
|
|
--echo # SET PASSWORD helps
|
|
set password for mysqltest1 = password('bla');
|
|
--exec $try_auth -u mysqltest1 -pbla
|
|
--replace_result $dreplace "drop user USER"
|
|
eval $dreplace, mysqltest1;
|
|
|
|
uninstall soname 'auth_socket';
|
|
uninstall soname 'auth_ed25519';
|
|
--remove_file $MYSQLTEST_VARDIR/tmp/peercred_test.txt
|