mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-16 12:02:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
mariadb/mysql-test/main/alter_user.result

126 lines
15 KiB
Text
Raw Normal View History

MDEV-17658 change the structure of mysql.user table Implement User_table_json. Fix scripts to use mysql.global_priv. Fix tests.
2018-11-24 14:13:41 +01:00
select priv into @root_priv from mysql.global_priv where user='root' and host='localhost';
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
select * from mysql.user where user = 'root' and host = 'localhost';
rename mysql.user and mysql.db column Truncate_versioning_priv->Delete_history_priv because the command and the privilege were renamed
2018-02-12 16:26:11 +01:00
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
SQL: truncate syntax and privilege [closes #229]
2017-09-08 09:22:24 +02:00
localhost root Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y 0 0 0 0 N N 0.000000
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
# Test syntax
#
# These 2 selects should have no changes from the first one.
alter user CURRENT_USER;
select * from mysql.user where user = 'root' and host = 'localhost';
rename mysql.user and mysql.db column Truncate_versioning_priv->Delete_history_priv because the command and the privilege were renamed
2018-02-12 16:26:11 +01:00
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
MDEV-12321 authentication plugin: SET PASSWORD support Support SET PASSWORD for authentication plugins. Authentication plugin API is extended with two optional methods: * hash_password() is used to compute a password hash (or digest) from the plain-text password. This digest will be stored in mysql.user table * preprocess_hash() is used to convert this digest into some memory representation that can be later used to authenticate a user. Build-in plugins convert the hash from hexadecimal or base64 to binary, to avoid doing it on every authentication attempt. Note a change in behavior: when loading privileges (on startup or on FLUSH PRIVILEGES) an account with an unknown plugin was loaded with a warning (e.g. "Plugin 'foo' is not loaded"). But such an account could not be used for authentication until the plugin is installed. Now an account like that will not be loaded at all (with a warning, still). Indeed, without plugin's preprocess_hash() method the server cannot know how to load an account. Thus, if a new authentication plugin is installed run-time, one might need FLUSH PRIVILEGES to activate all existing accounts that were using this new plugin.
2018-10-17 12:48:13 +02:00
localhost root Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y 0 0 0 0 mysql_native_password N N 0.000000
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
alter user CURRENT_USER();
select * from mysql.user where user = 'root' and host = 'localhost';
rename mysql.user and mysql.db column Truncate_versioning_priv->Delete_history_priv because the command and the privilege were renamed
2018-02-12 16:26:11 +01:00
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
MDEV-12321 authentication plugin: SET PASSWORD support Support SET PASSWORD for authentication plugins. Authentication plugin API is extended with two optional methods: * hash_password() is used to compute a password hash (or digest) from the plain-text password. This digest will be stored in mysql.user table * preprocess_hash() is used to convert this digest into some memory representation that can be later used to authenticate a user. Build-in plugins convert the hash from hexadecimal or base64 to binary, to avoid doing it on every authentication attempt. Note a change in behavior: when loading privileges (on startup or on FLUSH PRIVILEGES) an account with an unknown plugin was loaded with a warning (e.g. "Plugin 'foo' is not loaded"). But such an account could not be used for authentication until the plugin is installed. Now an account like that will not be loaded at all (with a warning, still). Indeed, without plugin's preprocess_hash() method the server cannot know how to load an account. Thus, if a new authentication plugin is installed run-time, one might need FLUSH PRIVILEGES to activate all existing accounts that were using this new plugin.
2018-10-17 12:48:13 +02:00
localhost root Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y 0 0 0 0 mysql_native_password N N 0.000000
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
create user foo;
select * from mysql.user where user = 'foo';
rename mysql.user and mysql.db column Truncate_versioning_priv->Delete_history_priv because the command and the privilege were renamed
2018-02-12 16:26:11 +01:00
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
Use mysql.user.authentication_string for password Don't distinguish between a "password hash" and "authentication string" anymore. Now both are stored in mysql.user.authentication_string, both are handled identically internally. A "password hash" is just how some particular plugins interpret authentication string. Set mysql.user.plugin even if there is no password. The server will use mysql_native_password plugin in these cases, let's make it expicit. Remove LEX_USER::pwhash.
2018-10-14 13:52:52 +02:00
% foo N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N 0 0 0 0 mysql_native_password N N 0.000000
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
alter user foo;
select * from mysql.user where user = 'foo';
rename mysql.user and mysql.db column Truncate_versioning_priv->Delete_history_priv because the command and the privilege were renamed
2018-02-12 16:26:11 +01:00
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
Use mysql.user.authentication_string for password Don't distinguish between a "password hash" and "authentication string" anymore. Now both are stored in mysql.user.authentication_string, both are handled identically internally. A "password hash" is just how some particular plugins interpret authentication string. Set mysql.user.plugin even if there is no password. The server will use mysql_native_password plugin in these cases, let's make it expicit. Remove LEX_USER::pwhash.
2018-10-14 13:52:52 +02:00
% foo N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N 0 0 0 0 mysql_native_password N N 0.000000
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
#
# Test READ_ONLY privilege works correctly with a read only database.
#
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
SET @start_read_only = @@global.read_only;
SET GLOBAL read_only=1;
grant create user on *.* to foo;
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
# Currently no READ_ONLY ADMIN privileges.
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
connect a, localhost, foo;
select @@global.read_only;
@@global.read_only
1
alter user foo;
ERROR HY000: The MariaDB server is running with the --read-only option so it cannot execute this statement
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
# Grant READ_ONLY ADMIN privilege to the user.
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
connection default;
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
grant READ_ONLY ADMIN on *.* to foo;
# We now have READ_ONLY ADMIN privilege. We should be able to run alter user.
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
connect b, localhost, foo;
alter user foo;
connection default;
SET GLOBAL read_only = @start_read_only;
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
#
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
# Test inexistant user.
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
#
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
alter user boo;
ERROR HY000: Operation ALTER USER failed for 'boo'
#--warning ER_CANNOT_USER
MDEV-17941 ALTER USER IF EXISTS does not work, although documentation says it should. Mistake in syntax definition fixed - should be ALTER USER IF EXISTS, not ALTER IF EXISTS USER.
2020-02-10 21:19:37 +01:00
alter user if exists boo;
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
Warnings:
Error 1133 Can't find any matching row in the user table
Note 1396 Operation ALTER USER failed for 'boo'
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
#
[MDEV-7978] Post review fixes and cleanups. * Maintain coding style in sql_yacc.yy in regards to optional clauses. * Remove unused variable from sql_acl.cc. * Update test case
2016-03-07 23:35:03 +01:00
# Test password related altering.
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
#
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
alter user foo identified by 'something';
select * from mysql.user where user = 'foo';
rename mysql.user and mysql.db column Truncate_versioning_priv->Delete_history_priv because the command and the privilege were renamed
2018-02-12 16:26:11 +01:00
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
% foo *88C89BE093D4ECF72D039F62EBB7477EA1FD4D63 N N N N N N N N N N N N N N N N N N N N N N N N N Y N N N N 0 0 0 0 mysql_native_password *88C89BE093D4ECF72D039F62EBB7477EA1FD4D63 N N 0.000000
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
alter user foo identified by 'something2';
select * from mysql.user where user = 'foo';
rename mysql.user and mysql.db column Truncate_versioning_priv->Delete_history_priv because the command and the privilege were renamed
2018-02-12 16:26:11 +01:00
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
% foo *9CD58369E930E28C8996A89DB18B63294E6DC10C N N N N N N N N N N N N N N N N N N N N N N N N N Y N N N N 0 0 0 0 mysql_native_password *9CD58369E930E28C8996A89DB18B63294E6DC10C N N 0.000000
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
alter user foo identified by password '*88C89BE093D4ECF72D039F62EBB7477EA1FD4D63';
select * from mysql.user where user = 'foo';
rename mysql.user and mysql.db column Truncate_versioning_priv->Delete_history_priv because the command and the privilege were renamed
2018-02-12 16:26:11 +01:00
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
% foo *88C89BE093D4ECF72D039F62EBB7477EA1FD4D63 N N N N N N N N N N N N N N N N N N N N N N N N N Y N N N N 0 0 0 0 mysql_native_password *88C89BE093D4ECF72D039F62EBB7477EA1FD4D63 N N 0.000000
MDEV-22974: mysql_native_password make "invalid" valid Per b9f3f06857ac, mysql_system_tables_data.sql creates a mysql_native_password with a salted hash of "invalid" so that `set password` will detect a native password can be applied:. SHOW CREATE USER; diligently uses this value in its output generating the SQL: MariaDB [(none)]> show create user; +---------------------------------------------------------------------------------------------------+ | CREATE USER for dan@localhost | +---------------------------------------------------------------------------------------------------+ | CREATE USER `dan`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket | +---------------------------------------------------------------------------------------------------+ Attempting to execute this before this patch results in: MariaDB [(none)]> CREATE USER `dan2`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket; ERROR 1372 (HY000): Password hash should be a 41-digit hexadecimal number As such, deep the implementation of mysql_native_password we make "invalid" valid (pun intended) such that the above create user will succeed. We do this by storing "*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" (credit: Oracle MySQL), that is of an INCORRECT length for a scramble. In native_password_authenticate we check the length of this cached value and immediately fail if it is anything other than the scramble length. native_password_get_salt is only called in the context of set_user_salt, so all setting of native passwords to hashed content of 'invalid', quite literally create an invalid password. So other forms of "invalid" are valid SQL in creating invalid passwords: MariaDB [(none)]> set password = 'invalid'; Query OK, 0 rows affected (0.001 sec) MariaDB [(none)]> alter user dan@localhost IDENTIFIED BY PASSWORD 'invalid'; Query OK, 0 rows affected (0.000 sec) closes #1628 Reviewer: serg@mariadb.com
2020-07-16 08:31:59 +02:00
alter user foo identified by password 'invalid';
select * from mysql.user where user = 'foo';
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
Merge 10.4 into 10.5
2020-11-03 15:24:47 +01:00
% foo invalid N N N N N N N N N N N N N N N N N N N N N N N N N Y N N N N 0 0 0 0 mysql_native_password invalid N N 0.000000
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
alter user foo identified with 'somecoolplugin';
MDEV-12321 authentication plugin: SET PASSWORD support Support SET PASSWORD for authentication plugins. Authentication plugin API is extended with two optional methods: * hash_password() is used to compute a password hash (or digest) from the plain-text password. This digest will be stored in mysql.user table * preprocess_hash() is used to convert this digest into some memory representation that can be later used to authenticate a user. Build-in plugins convert the hash from hexadecimal or base64 to binary, to avoid doing it on every authentication attempt. Note a change in behavior: when loading privileges (on startup or on FLUSH PRIVILEGES) an account with an unknown plugin was loaded with a warning (e.g. "Plugin 'foo' is not loaded"). But such an account could not be used for authentication until the plugin is installed. Now an account like that will not be loaded at all (with a warning, still). Indeed, without plugin's preprocess_hash() method the server cannot know how to load an account. Thus, if a new authentication plugin is installed run-time, one might need FLUSH PRIVILEGES to activate all existing accounts that were using this new plugin.
2018-10-17 12:48:13 +02:00
ERROR HY000: Operation ALTER USER failed for 'foo'@'%'
show warnings;
Level Code Message
MDEV-11340 Allow multiple alternative authentication methods for the same user introduce the syntax ... IDENTIFIED { WITH | VIA } plugin [ { USING | AS } auth ] [ OR plugin [ { USING | AS } auth ] [ OR ... ]] Server will try auth plugins in the specified order until the first success. No protocol changes, server uses the existing "switch plugin" packet. The auth chain is stored in json as "auth_or":[{"plugin":"xxx","authentication_string":"yyy"}, {}, {"plugin":"foo","authentication_string":"bar"}, ...], "plugin":"aaa", "authentication_string":"bbb" Note: * "auth_or" implies that there might be "auth_and" someday; * one entry in the array is an empty object, meaning to take plugin/auth from the main json object. This preserves compatibility with the existing mysql.global_priv table and with the mysql.user view. This entry is preferrably a mysql_native_password plugin for a non-empty mysql.user.password column. SET PASSWORD is supported and changes the password for the *first* plugin in the chain that has a notion of a "password"
2019-01-10 13:51:51 +01:00
Error 1524 Plugin 'somecoolplugin' is not loaded
MDEV-12321 authentication plugin: SET PASSWORD support Support SET PASSWORD for authentication plugins. Authentication plugin API is extended with two optional methods: * hash_password() is used to compute a password hash (or digest) from the plain-text password. This digest will be stored in mysql.user table * preprocess_hash() is used to convert this digest into some memory representation that can be later used to authenticate a user. Build-in plugins convert the hash from hexadecimal or base64 to binary, to avoid doing it on every authentication attempt. Note a change in behavior: when loading privileges (on startup or on FLUSH PRIVILEGES) an account with an unknown plugin was loaded with a warning (e.g. "Plugin 'foo' is not loaded"). But such an account could not be used for authentication until the plugin is installed. Now an account like that will not be loaded at all (with a warning, still). Indeed, without plugin's preprocess_hash() method the server cannot know how to load an account. Thus, if a new authentication plugin is installed run-time, one might need FLUSH PRIVILEGES to activate all existing accounts that were using this new plugin.
2018-10-17 12:48:13 +02:00
Error 1396 Operation ALTER USER failed for 'foo'@'%'
alter user foo identified with 'mysql_old_password';
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
select * from mysql.user where user = 'foo';
rename mysql.user and mysql.db column Truncate_versioning_priv->Delete_history_priv because the command and the privilege were renamed
2018-02-12 16:26:11 +01:00
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
% foo N N N N N N N N N N N N N N N N N N N N N N N N N Y N N N N 0 0 0 0 mysql_old_password N N 0.000000
MDEV-12321 authentication plugin: SET PASSWORD support Support SET PASSWORD for authentication plugins. Authentication plugin API is extended with two optional methods: * hash_password() is used to compute a password hash (or digest) from the plain-text password. This digest will be stored in mysql.user table * preprocess_hash() is used to convert this digest into some memory representation that can be later used to authenticate a user. Build-in plugins convert the hash from hexadecimal or base64 to binary, to avoid doing it on every authentication attempt. Note a change in behavior: when loading privileges (on startup or on FLUSH PRIVILEGES) an account with an unknown plugin was loaded with a warning (e.g. "Plugin 'foo' is not loaded"). But such an account could not be used for authentication until the plugin is installed. Now an account like that will not be loaded at all (with a warning, still). Indeed, without plugin's preprocess_hash() method the server cannot know how to load an account. Thus, if a new authentication plugin is installed run-time, one might need FLUSH PRIVILEGES to activate all existing accounts that were using this new plugin.
2018-10-17 12:48:13 +02:00
alter user foo identified with 'mysql_old_password' using '0123456789ABCDEF';
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
select * from mysql.user where user = 'foo';
rename mysql.user and mysql.db column Truncate_versioning_priv->Delete_history_priv because the command and the privilege were renamed
2018-02-12 16:26:11 +01:00
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
% foo 0123456789ABCDEF N N N N N N N N N N N N N N N N N N N N N N N N N Y N N N N 0 0 0 0 mysql_old_password 0123456789ABCDEF N N 0.000000
#
[MDEV-7978] Post review fixes and cleanups. * Maintain coding style in sql_yacc.yy in regards to optional clauses. * Remove unused variable from sql_acl.cc. * Update test case
2016-03-07 23:35:03 +01:00
# Test ssl related altering.
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
#
[MDEV-7978] Post review fixes and cleanups. * Maintain coding style in sql_yacc.yy in regards to optional clauses. * Remove unused variable from sql_acl.cc. * Update test case
2016-03-07 23:35:03 +01:00
alter user foo identified by 'something' require SSL;
select * from mysql.user where user = 'foo';
rename mysql.user and mysql.db column Truncate_versioning_priv->Delete_history_priv because the command and the privilege were renamed
2018-02-12 16:26:11 +01:00
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
% foo *88C89BE093D4ECF72D039F62EBB7477EA1FD4D63 N N N N N N N N N N N N N N N N N N N N N N N N N Y N N N N ANY 0 0 0 0 mysql_native_password *88C89BE093D4ECF72D039F62EBB7477EA1FD4D63 N N 0.000000
[MDEV-7978] Post review fixes and cleanups. * Maintain coding style in sql_yacc.yy in regards to optional clauses. * Remove unused variable from sql_acl.cc. * Update test case
2016-03-07 23:35:03 +01:00
alter user foo identified by 'something' require X509;
select * from mysql.user where user = 'foo';
rename mysql.user and mysql.db column Truncate_versioning_priv->Delete_history_priv because the command and the privilege were renamed
2018-02-12 16:26:11 +01:00
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
% foo *88C89BE093D4ECF72D039F62EBB7477EA1FD4D63 N N N N N N N N N N N N N N N N N N N N N N N N N Y N N N N X509 0 0 0 0 mysql_native_password *88C89BE093D4ECF72D039F62EBB7477EA1FD4D63 N N 0.000000
[MDEV-7978] Post review fixes and cleanups. * Maintain coding style in sql_yacc.yy in regards to optional clauses. * Remove unused variable from sql_acl.cc. * Update test case
2016-03-07 23:35:03 +01:00
alter user foo identified by 'something'
require cipher 'text' issuer 'foo_issuer' subject 'foo_subject';
select * from mysql.user where user = 'foo';
rename mysql.user and mysql.db column Truncate_versioning_priv->Delete_history_priv because the command and the privilege were renamed
2018-02-12 16:26:11 +01:00
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
% foo *88C89BE093D4ECF72D039F62EBB7477EA1FD4D63 N N N N N N N N N N N N N N N N N N N N N N N N N Y N N N N SPECIFIED text foo_issuer foo_subject 0 0 0 0 mysql_native_password *88C89BE093D4ECF72D039F62EBB7477EA1FD4D63 N N 0.000000
#
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
# Test resource limits altering.
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
#
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
alter user foo with MAX_QUERIES_PER_HOUR 10
MAX_UPDATES_PER_HOUR 20
MAX_CONNECTIONS_PER_HOUR 30
MAX_USER_CONNECTIONS 40;
select * from mysql.user where user = 'foo';
rename mysql.user and mysql.db column Truncate_versioning_priv->Delete_history_priv because the command and the privilege were renamed
2018-02-12 16:26:11 +01:00
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv Delete_history_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role max_statement_time
MDEV-21743 Split up SUPER privilege to smaller privileges
2020-02-28 18:59:01 +01:00
% foo *88C89BE093D4ECF72D039F62EBB7477EA1FD4D63 N N N N N N N N N N N N N N N N N N N N N N N N N Y N N N N SPECIFIED text foo_issuer foo_subject 10 20 30 40 mysql_native_password *88C89BE093D4ECF72D039F62EBB7477EA1FD4D63 N N 0.000000
[MDEV-7978] Implement alter user and tested create user Implemented the alter user syntax. Also tested that create user creates users accordingly.
2016-01-18 01:16:59 +01:00
drop user foo;
test cases for MySQL bugs also fix a comment, and update a macro just in case
2022-01-21 12:40:20 +01:00
#
# Bug #29882299: ALTER USER ... IDENTIFIED WITH ... BY ... SHOULD BE A PRIVILEGED OPERATION
#
create user foo@localhost;
connect x,localhost,foo;
alter user current_user identified with 'something';
ERROR 42000: Access denied; you need (at least one of) the CREATE USER privilege(s) for this operation
connection default;
disconnect x;
drop user foo@localhost;
MDEV-17658 change the structure of mysql.user table Implement User_table_json. Fix scripts to use mysql.global_priv. Fix tests.
2018-11-24 14:13:41 +01:00
update mysql.global_priv set priv=@root_priv where user='root' and host='localhost';
Reference in a new issue Copy permalink