Skip to content

Commit f4c5646

Browse files
author
Todd Farmer
committed
WL#7724 - Add support for proxy user mapping to
mysql_native_password and sha256_password authentication plugins.
1 parent b76eab1 commit f4c5646

39 files changed

+3104
-32
lines changed

‎include/mysql/plugin_auth_common.h

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#ifndef MYSQL_PLUGIN_AUTH_COMMON_INCLUDED
2-
/* Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved.
2+
/* Copyright (c) 2010, 2015, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -83,6 +83,12 @@
8383
*/
8484
#define CR_OK_HANDSHAKE_COMPLETE -2
8585

86+
/**
87+
Flag to be passed back to server from authentication plugins via
88+
authenticated_as when proxy mapping should be done by the server.
89+
*/
90+
#define PROXY_FLAG 0
91+
8692
/*
8793
We need HANDLE definition if on Windows. Define WIN32_LEAN_AND_MEAN (if
8894
not already done) to minimize amount of imported declarations.

‎mysql-test/r/mysqld--help-notwin.result

+23
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,12 @@ The following options may be given as the first argument:
152152
Set the default character set.
153153
--character-sets-dir=name
154154
Directory where character sets are
155+
--check-proxy-users If set to FALSE (the default), then proxy user identity
156+
will not be mapped for authentication plugins which
157+
support mapping from grant tables. When set to TRUE,
158+
users associated with authentication plugins which signal
159+
proxy user mapping should be done according to GRANT
160+
PROXY privilege definition.
155161
-r, --chroot=name Chroot mysqld daemon during startup.
156162
--collation-server=name
157163
Set the default collation.
@@ -553,6 +559,13 @@ The following options may be given as the first argument:
553559
NULLS_UNEQUAL (default behavior for 4.1 and later),
554560
NULLS_EQUAL (emulate 4.0 behavior), and NULLS_IGNORED
555561
--myisam-use-mmap Use memory mapping for reading and writing MyISAM tables
562+
--mysql-native-password-proxy-users
563+
If set to FALSE (the default), then the
564+
mysql_native_password plugin will not signal for
565+
authenticated users to be checked for mapping to proxy
566+
users. When set to TRUE, the plugin will flag associated
567+
authenticated accounts to be mapped to proxy users when
568+
the server option check_proxy_users is enabled.
556569
--net-buffer-length=#
557570
Buffer length for TCP/IP and socket communication
558571
--net-read-timeout=#
@@ -958,6 +971,13 @@ The following options may be given as the first argument:
958971
Track changes to the 'session state'.
959972
--session-track-system-variables=name
960973
Track changes in registered system variables.
974+
--sha256-password-proxy-users
975+
If set to FALSE (the default), then the sha256_password
976+
authentication plugin will not signal for authenticated
977+
users to be checked for mapping to proxy users. When set
978+
to TRUE, the plugin will flag associated authenticated
979+
accounts to be mapped to proxy users when the server
980+
option check_proxy_users is enabled.
961981
--show-compatibility-56
962982
SHOW commands / INFORMATION_SCHEMA tables compatible with
963983
MySQL 5.6
@@ -1185,6 +1205,7 @@ character-set-client-handshake TRUE
11851205
character-set-filesystem binary
11861206
character-set-server latin1
11871207
character-sets-dir MYSQL_CHARSETSDIR/
1208+
check-proxy-users FALSE
11881209
chroot (No default value)
11891210
collation-server latin1_swedish_ci
11901211
completion-type NO_CHAIN
@@ -1315,6 +1336,7 @@ myisam-repair-threads 1
13151336
myisam-sort-buffer-size 8388608
13161337
myisam-stats-method nulls_unequal
13171338
myisam-use-mmap FALSE
1339+
mysql-native-password-proxy-users FALSE
13181340
net-buffer-length 16384
13191341
net-read-timeout 30
13201342
net-retry-count 10
@@ -1426,6 +1448,7 @@ session-track-gtids OFF
14261448
session-track-schema TRUE
14271449
session-track-state-change FALSE
14281450
session-track-system-variables time_zone,autocommit,character_set_client,character_set_results,character_set_connection
1451+
sha256-password-proxy-users FALSE
14291452
show-compatibility-56 TRUE
14301453
show-old-temporals FALSE
14311454
show-slave-auth-info FALSE

‎mysql-test/r/mysqld--help-win.result

+23
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,12 @@ The following options may be given as the first argument:
152152
Set the default character set.
153153
--character-sets-dir=name
154154
Directory where character sets are
155+
--check-proxy-users If set to FALSE (the default), then proxy user identity
156+
will not be mapped for authentication plugins which
157+
support mapping from grant tables. When set to TRUE,
158+
users associated with authentication plugins which signal
159+
proxy user mapping should be done according to GRANT
160+
PROXY privilege definition.
155161
-r, --chroot=name Chroot mysqld daemon during startup.
156162
--collation-server=name
157163
Set the default collation.
@@ -543,6 +549,13 @@ The following options may be given as the first argument:
543549
NULLS_UNEQUAL (default behavior for 4.1 and later),
544550
NULLS_EQUAL (emulate 4.0 behavior), and NULLS_IGNORED
545551
--myisam-use-mmap Use memory mapping for reading and writing MyISAM tables
552+
--mysql-native-password-proxy-users
553+
If set to FALSE (the default), then the
554+
mysql_native_password plugin will not signal for
555+
authenticated users to be checked for mapping to proxy
556+
users. When set to TRUE, the plugin will flag associated
557+
authenticated accounts to be mapped to proxy users when
558+
the server option check_proxy_users is enabled.
546559
--named-pipe Enable the named pipe (NT)
547560
--net-buffer-length=#
548561
Buffer length for TCP/IP and socket communication
@@ -949,6 +962,13 @@ The following options may be given as the first argument:
949962
Track changes to the 'session state'.
950963
--session-track-system-variables=name
951964
Track changes in registered system variables.
965+
--sha256-password-proxy-users
966+
If set to FALSE (the default), then the sha256_password
967+
authentication plugin will not signal for authenticated
968+
users to be checked for mapping to proxy users. When set
969+
to TRUE, the plugin will flag associated authenticated
970+
accounts to be mapped to proxy users when the server
971+
option check_proxy_users is enabled.
952972
--shared-memory Enable the shared memory
953973
--shared-memory-base-name=name
954974
Base name of shared memory
@@ -1184,6 +1204,7 @@ character-set-client-handshake TRUE
11841204
character-set-filesystem binary
11851205
character-set-server latin1
11861206
character-sets-dir MYSQL_CHARSETSDIR/
1207+
check-proxy-users FALSE
11871208
chroot (No default value)
11881209
collation-server latin1_swedish_ci
11891210
completion-type NO_CHAIN
@@ -1310,6 +1331,7 @@ myisam-repair-threads 1
13101331
myisam-sort-buffer-size 8388608
13111332
myisam-stats-method nulls_unequal
13121333
myisam-use-mmap FALSE
1334+
mysql-native-password-proxy-users FALSE
13131335
named-pipe FALSE
13141336
net-buffer-length 16384
13151337
net-read-timeout 30
@@ -1422,6 +1444,7 @@ session-track-gtids OFF
14221444
session-track-schema TRUE
14231445
session-track-state-change FALSE
14241446
session-track-system-variables time_zone,autocommit,character_set_client,character_set_results,character_set_connection
1447+
sha256-password-proxy-users FALSE
14251448
shared-memory FALSE
14261449
shared-memory-base-name MYSQL
14271450
show-compatibility-56 TRUE

‎mysql-test/suite/perfschema/r/show_sanity.result

+3
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,9 @@ where show_mode = "5.7"
313313
and source = "P_S.SESSION_VARIABLES")
314314
order by show_mode, source, variable_name;
315315
SHOW_MODE SOURCE VARIABLE_NAME
316+
5.6 I_S.SESSION_VARIABLES CHECK_PROXY_USERS
317+
5.6 I_S.SESSION_VARIABLES MYSQL_NATIVE_PASSWORD_PROXY_USERS
318+
5.6 I_S.SESSION_VARIABLES SHA256_PASSWORD_PROXY_USERS
316319

317320
================================================================================
318321
TEST 5

‎mysql-test/suite/sys_vars/r/check_proxy_users_basic.result

+115
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
SET @start_value = @@global.check_proxy_users;
2+
SELECT @start_value;
3+
@start_value
4+
0
5+
'#----- 1.2.2.3 Default ---------------------------------------#'
6+
SET @@global.check_proxy_users = 1;
7+
SET @@global.check_proxy_users = DEFAULT;
8+
SELECT @@global.check_proxy_users;
9+
@@global.check_proxy_users
10+
0
11+
SET @@global.check_proxy_users = @start_value;
12+
SELECT @@global.check_proxy_users = 0;
13+
@@global.check_proxy_users = 0
14+
1
15+
'#----- 1.2.1 Valid values -------------------------------------#'
16+
SET @@global.check_proxy_users = 0;
17+
SELECT @@global.check_proxy_users;
18+
@@global.check_proxy_users
19+
0
20+
SET @@global.check_proxy_users = 1;
21+
SELECT @@global.check_proxy_users;
22+
@@global.check_proxy_users
23+
1
24+
SET @@global.check_proxy_users = TRUE;
25+
SELECT @@global.check_proxy_users;
26+
@@global.check_proxy_users
27+
1
28+
SET @@global.check_proxy_users = FALSE;
29+
SELECT @@global.check_proxy_users;
30+
@@global.check_proxy_users
31+
0
32+
SET @@global.check_proxy_users = ON;
33+
SELECT @@global.check_proxy_users;
34+
@@global.check_proxy_users
35+
1
36+
SET @@global.check_proxy_users = OFF;
37+
SELECT @@global.check_proxy_users;
38+
@@global.check_proxy_users
39+
0
40+
'#----- 1.2.1 Invalid values -----------------------------------#'
41+
SET @@global.check_proxy_users = -1;
42+
ERROR 42000: Variable 'check_proxy_users' can't be set to the value of '-1'
43+
SELECT @@global.check_proxy_users;
44+
@@global.check_proxy_users
45+
0
46+
SET @@global.check_proxy_users = 4294967296;
47+
ERROR 42000: Variable 'check_proxy_users' can't be set to the value of '4294967296'
48+
SELECT @@global.check_proxy_users;
49+
@@global.check_proxy_users
50+
0
51+
SET @@global.check_proxy_users = 10240022115;
52+
ERROR 42000: Variable 'check_proxy_users' can't be set to the value of '10240022115'
53+
SELECT @@global.check_proxy_users;
54+
@@global.check_proxy_users
55+
0
56+
SET @@global.check_proxy_users = 10000.01;
57+
ERROR 42000: Incorrect argument type to variable 'check_proxy_users'
58+
SELECT @@global.check_proxy_users;
59+
@@global.check_proxy_users
60+
0
61+
SET @@global.check_proxy_users = -1024;
62+
ERROR 42000: Variable 'check_proxy_users' can't be set to the value of '-1024'
63+
SELECT @@global.check_proxy_users;
64+
@@global.check_proxy_users
65+
0
66+
SET @@global.check_proxy_users = 42949672950;
67+
ERROR 42000: Variable 'check_proxy_users' can't be set to the value of '42949672950'
68+
SELECT @@global.check_proxy_users;
69+
@@global.check_proxy_users
70+
0
71+
SET @@global.check_proxy_users = 'test';
72+
ERROR 42000: Variable 'check_proxy_users' can't be set to the value of 'test'
73+
SELECT @@global.check_proxy_users;
74+
@@global.check_proxy_users
75+
0
76+
'#----- 1.2.5 Global/Session variable ---------------------------#'
77+
SET @@session.check_proxy_users = 0;
78+
ERROR HY000: Variable 'check_proxy_users' is a GLOBAL variable and should be set with SET GLOBAL
79+
SELECT @@check_proxy_users;
80+
@@check_proxy_users
81+
0
82+
SELECT IF(@@global.check_proxy_users, "ON", "OFF") = VARIABLE_VALUE
83+
FROM INFORMATION_SCHEMA.GLOBAL_VARIABLES
84+
WHERE VARIABLE_NAME='check_proxy_users';
85+
IF(@@global.check_proxy_users, "ON", "OFF") = VARIABLE_VALUE
86+
1
87+
SELECT IF(@@check_proxy_users, "ON", "OFF") = VARIABLE_VALUE
88+
FROM INFORMATION_SCHEMA.SESSION_VARIABLES
89+
WHERE VARIABLE_NAME='check_proxy_users';
90+
IF(@@check_proxy_users, "ON", "OFF") = VARIABLE_VALUE
91+
1
92+
SET @@global.check_proxy_users = 1;
93+
SELECT @@check_proxy_users = @@global.check_proxy_users;
94+
@@check_proxy_users = @@global.check_proxy_users
95+
1
96+
'#----- 1.2.6 Global/Session variable ---------------------------#'
97+
SET check_proxy_users = 1;
98+
ERROR HY000: Variable 'check_proxy_users' is a GLOBAL variable and should be set with SET GLOBAL
99+
SELECT @@check_proxy_users;
100+
@@check_proxy_users
101+
1
102+
SET local.check_proxy_users = 1;
103+
ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'local.check_proxy_users = 1' at line 1
104+
SELECT local.check_proxy_users;
105+
ERROR 42S02: Unknown table 'local' in field list
106+
SET global.check_proxy_users = 1;
107+
ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'global.check_proxy_users = 1' at line 1
108+
SELECT global.check_proxy_users;
109+
ERROR 42S02: Unknown table 'global' in field list
110+
SELECT check_proxy_users = @@session.check_proxy_users;
111+
ERROR 42S22: Unknown column 'check_proxy_users' in 'field list'
112+
SET @@global.check_proxy_users = @start_value;
113+
SELECT @@global.check_proxy_users;
114+
@@global.check_proxy_users
115+
0

‎mysql-test/suite/sys_vars/r/check_proxy_users_cmdl.result

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
SELECT @@global.check_proxy_users;
2+
@@global.check_proxy_users
3+
1
4+
'#----- 1.1.1 Valid values on cmd line -----------------------#'
5+
SELECT @@global.check_proxy_users;
6+
@@global.check_proxy_users
7+
1
8+
'#----- 1.1.2 Valid values on cmd line -----------------------#'
9+
SELECT @@global.check_proxy_users;
10+
@@global.check_proxy_users
11+
1
12+
'#----- 1.1.3 Invalid values on cmd line -----------------------#'
13+
CALL mtr.add_suppression("option 'check_proxy_users': boolean value '-1' wasn't recognized. Set to OFF.");
14+
SELECT @@global.check_proxy_users;
15+
@@global.check_proxy_users
16+
0
17+
CALL mtr.add_suppression("option 'check_proxy_users': boolean value '43698' wasn't recognized. Set to OFF.");
18+
SELECT @@global.check_proxy_users;
19+
@@global.check_proxy_users
20+
0
21+
CALL mtr.add_suppression("option 'check_proxy_users': boolean value 'TEST' wasn't recognized. Set to OFF.");
22+
SELECT @@global.check_proxy_users;
23+
@@global.check_proxy_users
24+
0
25+
'#----- 1.1.4 Invalid values on cmd line -----------------------#'
26+
CALL mtr.add_suppression("option 'check_proxy_users': boolean value ''test'' wasn't recognized. Set to OFF.");
27+
SELECT @@global.check_proxy_users;
28+
@@global.check_proxy_users
29+
0
30+
'#----- 1.1.5 empty values on cmd line -----------------------#'
31+
CALL mtr.add_suppression("option 'check_proxy_users': boolean value '' wasn't recognized. Set to OFF.");
32+
SELECT @@global.check_proxy_users;
33+
@@global.check_proxy_users
34+
0

‎mysql-test/suite/sys_vars/r/check_proxy_users_func.result

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
** Setup **
2+
3+
SET @default_check_proxy_users = @@check_proxy_users;
4+
'#----- 1.2.4 superuser set variable -------------------------#'
5+
SET Global check_proxy_users=OFF;
6+
'#----- 1.2.4 others user set variable -----------------------#'
7+
** Creating new user with out super privilege**
8+
CREATE USER sameea;
9+
** Connecting connn using username 'sameea' **
10+
SET GLOBAL check_proxy_users=ON;
11+
ERROR 42000: Access denied; you need (at least one of) the SUPER privilege(s) for this operation
12+
SET @@global.check_proxy_users=ON;
13+
ERROR 42000: Access denied; you need (at least one of) the SUPER privilege(s) for this operation
14+
** Connection default **
15+
** Disconnecting connn **
16+
DROP USER sameea;
17+
SET global check_proxy_users = @default_check_proxy_users;

0 commit comments

Comments
 (0)