Skip to content

Commit d5b27a9

Browse files
CbcWestwolfCbcWestwolf
authored
*: make default_authentication_plugin more compatible with mysql (#56660)
close #54138
1 parent c82ba4e commit d5b27a9

File tree

5 files changed

+125
-10
lines changed

5 files changed

+125
-10
lines changed

‎pkg/executor/grant.go

+10-5
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ import (
3333
"github.com/pingcap/tidb/pkg/privilege"
3434
"github.com/pingcap/tidb/pkg/privilege/privileges"
3535
"github.com/pingcap/tidb/pkg/sessionctx"
36+
"github.com/pingcap/tidb/pkg/sessionctx/variable"
3637
"github.com/pingcap/tidb/pkg/sessiontxn"
3738
"github.com/pingcap/tidb/pkg/table"
3839
"github.com/pingcap/tidb/pkg/util"
@@ -160,14 +161,18 @@ func (e *GrantExec) Next(ctx context.Context, _ *chunk.Chunk) error {
160161
if err != nil {
161162
return err
162163
}
163-
if !exists && e.Ctx().GetSessionVars().SQLMode.HasNoAutoCreateUserMode() {
164-
return exeerrors.ErrCantCreateUserWithGrant
165-
} else if !exists {
164+
if !exists {
165+
if e.Ctx().GetSessionVars().SQLMode.HasNoAutoCreateUserMode() {
166+
return exeerrors.ErrCantCreateUserWithGrant
167+
}
166168
// This code path only applies if mode NO_AUTO_CREATE_USER is unset.
167169
// It is required for compatibility with 5.7 but removed from 8.0
168170
// since it results in a massive security issue:
169171
// spelling errors will create users with no passwords.
170-
authPlugin := mysql.AuthNativePassword
172+
authPlugin, err := e.Ctx().GetSessionVars().GlobalVarsAccessor.GetGlobalSysVar(variable.DefaultAuthPlugin)
173+
if err != nil {
174+
return err
175+
}
171176
if user.AuthOpt != nil && user.AuthOpt.AuthPlugin != "" {
172177
authPlugin = user.AuthOpt.AuthPlugin
173178
}
@@ -180,7 +185,7 @@ func (e *GrantExec) Next(ctx context.Context, _ *chunk.Chunk) error {
180185
if !ok {
181186
return errors.Trace(exeerrors.ErrPasswordFormat)
182187
}
183-
_, err := internalSession.GetSQLExecutor().ExecuteInternal(internalCtx,
188+
_, err = internalSession.GetSQLExecutor().ExecuteInternal(internalCtx,
184189
`INSERT INTO %n.%n (Host, User, authentication_string, plugin) VALUES (%?, %?, %?, %?);`,
185190
mysql.SystemDB, mysql.UserTable, user.User.Hostname, user.User.Username, pwd, authPlugin)
186191
if err != nil {

‎pkg/executor/show.go

+7-4
Original file line numberDiff line numberDiff line change
@@ -1761,9 +1761,12 @@ func (e *ShowExec) fetchShowCreateUser(ctx context.Context) error {
17611761
fmt.Sprintf("'%s'@'%s'", e.User.Username, e.User.Hostname))
17621762
}
17631763

1764-
authplugin := mysql.AuthNativePassword
1764+
authPlugin, err := e.Ctx().GetSessionVars().GlobalVarsAccessor.GetGlobalSysVar(variable.DefaultAuthPlugin)
1765+
if err != nil {
1766+
return errors.Trace(err)
1767+
}
17651768
if len(rows) == 1 && rows[0].GetString(0) != "" {
1766-
authplugin = rows[0].GetString(0)
1769+
authPlugin = rows[0].GetString(0)
17671770
}
17681771

17691772
accountLockedRaw := rows[0].GetString(1)
@@ -1841,13 +1844,13 @@ func (e *ShowExec) fetchShowCreateUser(ctx context.Context) error {
18411844

18421845
authData := checker.GetEncodedPassword(e.User.Username, e.User.Hostname)
18431846
authStr := ""
1844-
if !(authplugin == mysql.AuthSocket && authData == "") {
1847+
if !(authPlugin == mysql.AuthSocket && authData == "") {
18451848
authStr = fmt.Sprintf(" AS '%s'", authData)
18461849
}
18471850

18481851
// FIXME: the returned string is not escaped safely
18491852
showStr := fmt.Sprintf("CREATE USER '%s'@'%s' IDENTIFIED WITH '%s'%s REQUIRE %s%s %s ACCOUNT %s PASSWORD HISTORY %s PASSWORD REUSE INTERVAL %s%s%s%s",
1850-
e.User.Username, e.User.Hostname, authplugin, authStr, require, tokenIssuer, passwordExpiredStr, accountLocked, passwordHistory, passwordReuseInterval, failedLoginAttempts, passwordLockTimeDays, userAttributes)
1853+
e.User.Username, e.User.Hostname, authPlugin, authStr, require, tokenIssuer, passwordExpiredStr, accountLocked, passwordHistory, passwordReuseInterval, failedLoginAttempts, passwordLockTimeDays, userAttributes)
18511854
e.appendRow([]any{showStr})
18521855
return nil
18531856
}

‎pkg/executor/simple.go

+5-1
Original file line numberDiff line numberDiff line change
@@ -1110,6 +1110,10 @@ func (e *SimpleExec) executeCreateUser(ctx context.Context, s *ast.CreateUserStm
11101110
if savePasswdHistory {
11111111
sqlescape.MustFormatSQL(sqlPasswordHistory, `INSERT INTO %n.%n (Host, User, Password) VALUES `, mysql.SystemDB, mysql.PasswordHistoryTable)
11121112
}
1113+
defaultAuthPlugin, err := e.Ctx().GetSessionVars().GlobalVarsAccessor.GetGlobalSysVar(variable.DefaultAuthPlugin)
1114+
if err != nil {
1115+
return errors.Trace(err)
1116+
}
11131117

11141118
users := make([]*auth.UserIdentity, 0, len(s.Specs))
11151119
for _, spec := range s.Specs {
@@ -1141,7 +1145,7 @@ func (e *SimpleExec) executeCreateUser(ctx context.Context, s *ast.CreateUserStm
11411145
e.Ctx().GetSessionVars().StmtCtx.AppendNote(err)
11421146
continue
11431147
}
1144-
authPlugin := mysql.AuthNativePassword
1148+
authPlugin := defaultAuthPlugin
11451149
if spec.AuthOpt != nil && spec.AuthOpt.AuthPlugin != "" {
11461150
authPlugin = spec.AuthOpt.AuthPlugin
11471151
}

‎tests/integrationtest/r/executor/simple.result

+60
Original file line numberDiff line numberDiff line change
@@ -454,3 +454,63 @@ id
454454
1
455455
2
456456
set autocommit = default;
457+
set global default_authentication_plugin = 'invalid_auth_plugin';
458+
Error 1231 (42000): Variable 'default_authentication_plugin' can't be set to the value of 'invalid_auth_plugin'
459+
set global default_authentication_plugin = 'auth_socket';
460+
Error 1231 (42000): Variable 'default_authentication_plugin' can't be set to the value of 'auth_socket'
461+
set global default_authentication_plugin = 'tidb_sm3_password';
462+
create user default_sm3_user;
463+
show create user default_sm3_user;
464+
CREATE USER for default_sm3_user@%
465+
CREATE USER 'default_sm3_user'@'%' IDENTIFIED WITH 'tidb_sm3_password' AS '' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT
466+
select plugin from mysql.user where user = 'default_sm3_user';
467+
plugin
468+
tidb_sm3_password
469+
set global default_authentication_plugin = 'caching_sha2_password';
470+
create user default_sha2_user;
471+
create user native_plugin_user identified with 'mysql_native_password';
472+
create role default_sha2_role;
473+
show create user default_sha2_user;
474+
CREATE USER for default_sha2_user@%
475+
CREATE USER 'default_sha2_user'@'%' IDENTIFIED WITH 'caching_sha2_password' AS '' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT
476+
select plugin from mysql.user where user = 'default_sha2_user';
477+
plugin
478+
caching_sha2_password
479+
show create user native_plugin_user;
480+
CREATE USER for native_plugin_user@%
481+
CREATE USER 'native_plugin_user'@'%' IDENTIFIED WITH 'mysql_native_password' AS '' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT
482+
select plugin from mysql.user where user = 'native_plugin_user';
483+
plugin
484+
mysql_native_password
485+
show create user default_sha2_role;
486+
CREATE USER for default_sha2_role@%
487+
CREATE USER 'default_sha2_role'@'%' IDENTIFIED WITH 'caching_sha2_password' AS '' REQUIRE NONE PASSWORD EXPIRE ACCOUNT LOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT
488+
select plugin from mysql.user where user = 'default_sha2_role';
489+
plugin
490+
caching_sha2_password
491+
alter user default_sha2_user identified with 'tidb_sm3_password';
492+
show create user default_sha2_user;
493+
CREATE USER for default_sha2_user@%
494+
CREATE USER 'default_sha2_user'@'%' IDENTIFIED WITH 'tidb_sm3_password' AS '' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT
495+
select plugin from mysql.user where user = 'default_sha2_user';
496+
plugin
497+
tidb_sm3_password
498+
alter user default_sha2_user identified with 'authentication_ldap_simple';
499+
show create user default_sha2_user;
500+
CREATE USER for default_sha2_user@%
501+
CREATE USER 'default_sha2_user'@'%' IDENTIFIED WITH 'authentication_ldap_simple' AS '' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT
502+
select plugin from mysql.user where user = 'default_sha2_user';
503+
plugin
504+
authentication_ldap_simple
505+
alter user default_sha2_user identified with 'authentication_ldap_sasl';
506+
show create user default_sha2_user;
507+
CREATE USER for default_sha2_user@%
508+
CREATE USER 'default_sha2_user'@'%' IDENTIFIED WITH 'authentication_ldap_sasl' AS '' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT
509+
select plugin from mysql.user where user = 'default_sha2_user';
510+
plugin
511+
authentication_ldap_sasl
512+
drop user default_sm3_user;
513+
drop user default_sha2_user;
514+
drop user native_plugin_user;
515+
drop user default_sha2_role;
516+
set global default_authentication_plugin = default;

‎tests/integrationtest/t/executor/simple.test

+43
Original file line numberDiff line numberDiff line change
@@ -487,3 +487,46 @@ rollback;
487487
select * from auto_new;
488488

489489
set autocommit = default;
490+
491+
# TestDefaultAuthPluginForCreateUser
492+
493+
connection default;
494+
495+
--error 1231
496+
set global default_authentication_plugin = 'invalid_auth_plugin';
497+
--error 1231
498+
set global default_authentication_plugin = 'auth_socket';
499+
500+
set global default_authentication_plugin = 'tidb_sm3_password';
501+
create user default_sm3_user;
502+
show create user default_sm3_user;
503+
select plugin from mysql.user where user = 'default_sm3_user';
504+
505+
set global default_authentication_plugin = 'caching_sha2_password';
506+
create user default_sha2_user;
507+
create user native_plugin_user identified with 'mysql_native_password';
508+
create role default_sha2_role;
509+
show create user default_sha2_user;
510+
select plugin from mysql.user where user = 'default_sha2_user';
511+
show create user native_plugin_user;
512+
select plugin from mysql.user where user = 'native_plugin_user';
513+
show create user default_sha2_role;
514+
select plugin from mysql.user where user = 'default_sha2_role';
515+
516+
alter user default_sha2_user identified with 'tidb_sm3_password';
517+
show create user default_sha2_user;
518+
select plugin from mysql.user where user = 'default_sha2_user';
519+
520+
alter user default_sha2_user identified with 'authentication_ldap_simple';
521+
show create user default_sha2_user;
522+
select plugin from mysql.user where user = 'default_sha2_user';
523+
524+
alter user default_sha2_user identified with 'authentication_ldap_sasl';
525+
show create user default_sha2_user;
526+
select plugin from mysql.user where user = 'default_sha2_user';
527+
528+
drop user default_sm3_user;
529+
drop user default_sha2_user;
530+
drop user native_plugin_user;
531+
drop user default_sha2_role;
532+
set global default_authentication_plugin = default;

0 commit comments

Comments
 (0)