Add custom authentication

[desdic]

I found a lot of references to mysql_clear_password but the handling was missing

[dveeden]

Maybe this should be bytes.TrimRight()? What if there are multiple \x00, like in the middle of the clientAuthData?

[desdic]

ah yes fixed

[lance6716]

Hi, I'm not sure about this option. Maybe it's not a server-side auth method, just to cooperate with other auth methods at client-side? https://dev.mysql.com/doc/refman/8.4/en/cleartext-pluggable-authentication.html

Can you provide some material about it?

[dveeden]

The info for this authentication method is here: https://dev.mysql.com/doc/dev/mysql-server/latest/page_protocol_connection_phase_authentication_methods_clear_text_password.html
Maybe we should link this in a comment?

So the mysql_clear_password authentication with MySQL would use either LDAP, PAM or something similar on the server side, it isn't stored in the mysql.user table. However we don't have to follow that.

[dveeden]

This should:

• have some tests
• have some very visible warnings about the security of this. Both in logging and comments in the code.

This could be a basis and/or demonstration for something that can be extended to do external authentication.

[dveeden]

Test failures are due to a Docker outage: https://www.dockerstatus.com/

[desdic]

This should:

• have some tests
• have some very visible warnings about the security of this. Both in logging and comments in the code.

This could be a basis and/or demonstration for something that can be extended to do external authentication.

Would it be better if I created an interface/struct for handling custom authentication ? so if needed one could implement the mysql_clear_password themselves or use some custom type of encryption ?

I guess what I'm trying to write is that (I'm building a proxy) and I do need the password provided since I'm just going to relay it to a backend. Is there anyway that I can optain the password/clientAuthData without make a custom type ?

[dveeden]

1. Yes making it easy to do custom auth would be good.
2. Note that with caching_sha2_password over TLS without a cached entry you also get a plaintext password. This might not be usable for you and is probably a bit too much of a hack. But this may have better/improved compatibility with clients. Just so you know.

[desdic]

making custom auth would also be the only way for a user of this library to get clientAuthData in raw form right ?

[dveeden]

making customer auth would also be the only way for a user of this library to get clientAuthData in raw form right ?

Yes, that's probably correct.

[desdic]

making customer auth would also be the only way for a user of this library to get clientAuthData in raw form right ?

Yes, that's probably correct.

Oki I'll redo my patch to make a custom authentication then :)

[desdic]

I haven't added any test to this yet since I wanted to check with you first if this is too invasive. But I have this running in my proxy using mysql_clear_password and then doing the authentication via the interface.

also test is failing even if I check out a fresh master

[desdic]

Oki hopefully last commit. I've added the authentication as an interface with a default one so behavior is the same as before but its possible to implement you own authentication and plugin validation

[desdic]

is my latest patch better ?