Add default password type

[evillique]

Changelog category (leave one):

• New Feature

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Password type in queries like CREATE USER u IDENTIFIED BY 'p' will be automatically set according to the setting default_password_type in the config.xml on the server. Closes #42915

Query parameters can now also be used to specify passwords, for example:
CREATE USER u IDENTIFIED BY {password:String}

[vitlibar]

So let's keep the plaintext password in a CREATE USER query and do on the server both hash calculating and password complexity checking.

[evillique]

Initially, I added functions makeAuthenticationData() and makeASTAuthenticationData() as methods to ASTAuthenticationData, but adding Context to clickhouse_parsers breaks the standalone keeper build, so I moved them to Interpreters.

Any suggestions on where to better put them are welcome

[vitlibar]

Could we move that transformation function to Access/AuthenticationData.h/cpp?

We can make it a member function of AuthenticationData, kind of AuthenticationData::fromAST()

[evillique]

It sounds like a good idea, but I'm afraid that it will run into the same problem, clickhouse_common_access is linked to clickhouse_parsers.

[vitlibar]

AuthenticationData.cpp was in clickhouse_common_access only because it was used in ASTCreateUser. Now that's not the case anymore.

[evillique]

But AuthenticationData.h/cpp is used both in ASTAuthenticationData and in ParseCreateUserQuery because of the AuthenticationType. Maybe I'm missing something?

[evillique]

We can do something like this:

static AuthenticationData::fromAST(
    ASTPtr query,
    const ASTs & prepared_arguments,
    std::optional<AuthenticationType> default_type
    //, std::optional<int> bcrypt_param - in the future
)

InterpreterCreateUserQuery::execute():

...
std::optional<AuthenticationData> auth_data;
if (query.auth_data)
{
    if (!query.attach)
    {
        auto password = auth_data->getPassword();
        if (password)
            global_context->getAccessControl().checkPasswordComplexityRules(*password);
    }

    AuthenticationType default_type = access_control.getDefaultPasswordType();
    ASTs args(args_size);
        for (size_t i = 0; i < args_size; ++i)
            args[i] = evaluateConstantExpressionAsLiteral(query.children[i], context);

    auth_data = AuthenticationData::fromAST(query, args, default_type);
}
...

Is it better?

[vitlibar]

But AuthenticationData.h/cpp is used both in ASTAuthenticationData and in ParseCreateUserQuery because of the AuthenticationType.

We can keep the AuthenticationType enum in the folder src/Access/Common and move AuthenticationData to src/Access.

[vitlibar]

What happened here?

[evillique]

Not related, just a small improvement

[evillique]

Should we check password complexity rules in the InterpreterCreateQuery or is here ok?

[vitlibar]

Both places seem ok.

[vitlibar]

I'd prefer to check them in the InterpreterCreateQuery to make the conversion function more simple, but that's not very important.

[evillique]

Test failures are unrelated.