mirror of
https://github.com/MariaDB/server.git
synced 2025-10-21 15:24:04 +02:00
5b15cc613e
introduce the syntax
... IDENTIFIED { WITH | VIA }
plugin [ { USING | AS } auth ]
[ OR plugin [ { USING | AS } auth ]
[ OR ... ]]
Server will try auth plugins in the specified order until the first
success. No protocol changes, server uses the existing "switch plugin"
packet.
The auth chain is stored in json as
"auth_or":[{"plugin":"xxx","authentication_string":"yyy"},
{},
{"plugin":"foo","authentication_string":"bar"},
...],
"plugin":"aaa", "authentication_string":"bbb"
Note:
* "auth_or" implies that there might be "auth_and" someday;
* one entry in the array is an empty object, meaning to take plugin/auth
from the main json object. This preserves compatibility with
the existing mysql.global_priv table and with the mysql.user view.
This entry is preferrably a mysql_native_password plugin for a
non-empty mysql.user.password column.
SET PASSWORD is supported and changes the password for the *first*
plugin in the chain that has a notion of a "password"
34 lines
1.4 KiB
Text
34 lines
1.4 KiB
Text
INSTALL SONAME 'auth_gssapi';
|
|
Warnings:
|
|
Note 1105 SSPI: using principal name 'localhost', mech 'Negotiate'
|
|
CREATE USER 'nosuchuser' IDENTIFIED WITH gssapi OR mysql_native_password as password("good");
|
|
connect(localhost,nosuchuser,,test,MASTER_MYPORT,MASTER_MYSOCK);
|
|
connect con1,localhost,nosuchuser,,;
|
|
ERROR 28000: Access denied for user 'nosuchuser'@'localhost' (using password: NO)
|
|
connect con1,localhost,nosuchuser,good,;
|
|
SELECT USER(),CURRENT_USER();
|
|
USER() CURRENT_USER()
|
|
nosuchuser@localhost nosuchuser@%
|
|
disconnect con1;
|
|
connection default;
|
|
DROP USER nosuchuser;
|
|
CREATE USER 'nosuchuser' IDENTIFIED WITH mysql_native_password as password("good") OR gssapi;
|
|
connect(localhost,nosuchuser,,test,MASTER_MYPORT,MASTER_MYSOCK);
|
|
connect con1,localhost,nosuchuser,,;
|
|
ERROR 28000: GSSAPI name mismatch, requested 'nosuchuser', actual name 'GSSAPI_SHORTNAME'
|
|
connect con1,localhost,nosuchuser,good,;
|
|
SELECT USER(),CURRENT_USER();
|
|
USER() CURRENT_USER()
|
|
nosuchuser@localhost nosuchuser@%
|
|
disconnect con1;
|
|
connection default;
|
|
DROP USER nosuchuser;
|
|
CREATE USER 'GSSAPI_SHORTNAME' IDENTIFIED WITH mysql_native_password as password("good") OR gssapi;
|
|
connect con1,localhost,$GSSAPI_SHORTNAME,,;
|
|
SELECT USER(),CURRENT_USER();
|
|
USER() CURRENT_USER()
|
|
GSSAPI_SHORTNAME@localhost GSSAPI_SHORTNAME@%
|
|
disconnect con1;
|
|
connection default;
|
|
DROP USER 'GSSAPI_SHORTNAME';
|
|
UNINSTALL SONAME 'auth_gssapi';
|