Skip to content

Commit 137e915

Browse files
author
Todd Farmer
committed
WL#7726, adding mysql_no_login authentication plugin, backported to 5.6
from trunk. Reviewed-by: Georgi Kodinov Reviewed-by: Kristofer Petterson Reviewed-by: Harin Vadodaria RB: 5336
1 parent c14af0e commit 137e915

File tree

7 files changed

+261
-1
lines changed

7 files changed

+261
-1
lines changed

‎mysql-test/include/have_mysql_no_login_plugin.inc‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#
2+
# Check if server has support for loading plugins
3+
#
4+
if (`SELECT @@have_dynamic_loading != 'YES'`) {
5+
--skip mysql_no_login requires dynamic loading
6+
}
7+
8+
#
9+
# Check if the variable MYSQL_NO_LOGIN is set
10+
#
11+
if (!$MYSQL_NO_LOGIN) {
12+
--skip mysql_no_login requires the environment variable \$MYSQL_NO_LOGIN to be set (normally done by mtr)
13+
}
14+
15+
#
16+
# Check if --plugin-dir was setup for mysql_no_login
17+
#
18+
if (`SELECT CONCAT('--plugin-dir=', REPLACE(@@plugin_dir, '\\\\', '/')) != '$MYSQL_NO_LOGIN_OPT/'`) {
19+
--skip mysql_no_login requires that --plugin-dir is set to the mysql_no_login dir (either the .opt file does not contain \$MYSQL_NO_LOGIN_OPT or another plugin is in use)
20+
}
21+

‎mysql-test/include/plugin.defs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,3 +45,4 @@ libdaemon_example plugin/daemon_example DAEMONEXAMPLE
4545
libmemcached plugin/innodb_memcached/daemon_memcached DAEMON_MEMCACHED daemon_memcached
4646
innodb_engine plugin/innodb_memcached/innodb_memcache INNODB_ENGINE
4747
validate_password plugin/password_validation VALIDATE_PASSWORD validate_password
48+
mysql_no_login plugin/mysql_no_login MYSQL_NO_LOGIN mysql_no_login

‎mysql-test/suite/auth_sec/r/mysql_no_login.result‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
INSTALL PLUGIN mysql_no_login SONAME 'mysql_no_login.so';
2+
SELECT PLUGIN_NAME, PLUGIN_STATUS, PLUGIN_TYPE, PLUGIN_DESCRIPTION
3+
FROM INFORMATION_SCHEMA.PLUGINS WHERE PLUGIN_NAME LIKE 'mysql_no_login';
4+
PLUGIN_NAME mysql_no_login
5+
PLUGIN_STATUS ACTIVE
6+
PLUGIN_TYPE AUTHENTICATION
7+
PLUGIN_DESCRIPTION No login authentication plugin
8+
Creating users noauth, otheruser
9+
Creating view, procedure, function
10+
# Connect as otheruser - should succeed.
11+
user() current_user() @@proxy_user
12+
otheruser@localhost otheruser@localhost NULL
13+
a
14+
2
15+
noauthdb.f1()
16+
5
17+
# Attempt to access underlying tables directly using otheruser - should fail.
18+
# Connect as noauth - should fail.
19+
#try to set password of this plugin user with password function - should warn
20+
SET PASSWORD FOR noauth@localhost = password('');
21+
Warnings:
22+
Note 1699 SET PASSWORD has no significance for users authenticating via plugins
23+
#try to set password of this plugin user with password hash - should warn
24+
grant all on *.* to noauth@localhost identified by password '*94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29';
25+
Warnings:
26+
Warning 1699 SET PASSWORD has no significance for users authenticating via plugins
27+
#try to expire password of this plugin user - should warn
28+
alter user noauth@localhost password expire;
29+
ERROR HY000: Operation ALTER USER failed for 'noauth'@'localhost'
30+
#uninstall plugin and try to login with this plugin user - should return error
31+
uninstall plugin mysql_no_login;
32+
# Connect as noauth - should fail.
33+
INSTALL PLUGIN mysql_no_login SONAME 'mysql_no_login.so';
34+
Creating users noauth, otheruser
35+
Creating view, procedure, function
36+
# Connect as otheruser - should succeed.
37+
user() current_user() @@proxy_user
38+
otheruser@localhost otheruser@localhost NULL
39+
a
40+
2
41+
noauthdb.f1()
42+
5
43+
# Attempt to access underlying tables directly using otheruser - should fail.

‎mysql-test/suite/auth_sec/t/mysql_no_login-master.opt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
$MYSQL_NO_LOGIN_OPT

‎mysql-test/suite/auth_sec/t/mysql_no_login.test‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
#
2+
# Testing MYSQL_NO_LOGIN authentication plugin.
3+
#
4+
--source include/have_mysql_no_login_plugin.inc
5+
6+
--replace_regex /\.dll/.so/
7+
eval INSTALL PLUGIN mysql_no_login SONAME '$MYSQL_NO_LOGIN';
8+
9+
query_vertical SELECT PLUGIN_NAME, PLUGIN_STATUS, PLUGIN_TYPE, PLUGIN_DESCRIPTION
10+
FROM INFORMATION_SCHEMA.PLUGINS WHERE PLUGIN_NAME LIKE 'mysql_no_login';
11+
12+
--disable_query_log
13+
CREATE DATABASE noauthdb;
14+
CREATE TABLE noauthdb.t1 (a INT);
15+
CREATE TABLE noauthdb.t2 (a INT);
16+
INSERT INTO noauthdb.t1 VALUES (1), (2);
17+
INSERT INTO noauthdb.t2 VALUES (3), (4);
18+
19+
--echo Creating users noauth, otheruser
20+
CREATE USER noauth@localhost IDENTIFIED WITH 'mysql_no_login';
21+
CREATE USER otheruser@localhost;
22+
GRANT SELECT, UPDATE, INSERT ON noauthdb.* TO noauth@localhost;
23+
24+
--echo Creating view, procedure, function
25+
CREATE DEFINER = noauth@localhost SQL SECURITY DEFINER VIEW noauthdb.v1 AS SELECT * FROM noauthdb.t1 WHERE a % 2 = 0;
26+
CREATE DEFINER = noauth@localhost PROCEDURE noauthdb.p1 () CONTAINS SQL SQL SECURITY DEFINER UPDATE noauthdb.t2 SET a = 5 WHERE a = 3;
27+
delimiter //;
28+
CREATE DEFINER = noauth@localhost FUNCTION noauthdb.f1() RETURNS INT CONTAINS SQL SQL SECURITY DEFINER
29+
BEGIN
30+
DECLARE outp INT DEFAULT NULL;
31+
SELECT MAX(a) INTO outp FROM noauthdb.t2;
32+
RETURN outp;
33+
END//
34+
delimiter ;//
35+
36+
GRANT SELECT ON noauthdb.v1 TO otheruser@localhost;
37+
GRANT EXECUTE ON noauthdb.* TO otheruser@localhost;
38+
GRANT EXECUTE ON noauthdb.* TO noauth@localhost;
39+
40+
--enable_query_log
41+
42+
--echo # Connect as otheruser - should succeed.
43+
--exec $MYSQL --user=otheruser -e "select user(), current_user(), @@proxy_user; SELECT * FROM noauthdb.v1; CALL noauthdb.p1(); SELECT noauthdb.f1();"
44+
45+
--echo # Attempt to access underlying tables directly using otheruser - should fail.
46+
--error 1, ER_TABLEACCESS_DENIED_ERROR
47+
--exec $MYSQL --user=otheruser -e "SELECT * FROM noauthdb.t1;"
48+
49+
--echo # Connect as noauth - should fail.
50+
--error 1, ER_ACCESS_DENIED_ERROR
51+
--exec $MYSQL --user=noauth -e "select user(), current_user(), @@proxy_user"
52+
53+
--echo #try to set password of this plugin user with password function - should warn
54+
SET PASSWORD FOR noauth@localhost = password('');
55+
56+
--echo #try to set password of this plugin user with password hash - should warn
57+
grant all on *.* to noauth@localhost identified by password '*94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29';
58+
59+
--echo #try to expire password of this plugin user - should warn
60+
--error ER_CANNOT_USER
61+
alter user noauth@localhost password expire;
62+
63+
--echo #uninstall plugin and try to login with this plugin user - should return error
64+
uninstall plugin mysql_no_login;
65+
--echo # Connect as noauth - should fail.
66+
--error 1, ER_PLUGIN_IS_NOT_LOADED
67+
--exec $MYSQL --user=noauth -e "select user(), current_user(), @@proxy_user"
68+
69+
# Cleanup
70+
--disable_query_log
71+
72+
DROP DATABASE noauthdb;
73+
DROP USER noauth@localhost;
74+
DROP USER otheruser@localhost;
75+
76+
--enable_query_log
77+
##proxy related scenario
78+
--replace_regex /\.dll/.so/
79+
eval INSTALL PLUGIN mysql_no_login SONAME '$MYSQL_NO_LOGIN';
80+
--disable_query_log
81+
CREATE DATABASE noauthdb;
82+
CREATE TABLE noauthdb.t1 (a INT);
83+
CREATE TABLE noauthdb.t2 (a INT);
84+
INSERT INTO noauthdb.t1 VALUES (1), (2);
85+
INSERT INTO noauthdb.t2 VALUES (3), (4);
86+
87+
--echo Creating users noauth, otheruser
88+
CREATE USER noauth@localhost IDENTIFIED WITH 'mysql_no_login';
89+
CREATE USER otheruser@localhost;
90+
GRANT PROXY ON 'noauth'@'localhost' TO 'otheruser'@'localhost';
91+
GRANT SELECT, UPDATE, INSERT ON noauthdb.* TO noauth@localhost;
92+
93+
--echo Creating view, procedure, function
94+
CREATE DEFINER = noauth@localhost SQL SECURITY DEFINER VIEW noauthdb.v1 AS SELECT * FROM noauthdb.t1 WHERE a % 2 = 0;
95+
CREATE DEFINER = noauth@localhost PROCEDURE noauthdb.p1 () CONTAINS SQL SQL SECURITY DEFINER UPDATE noauthdb.t2 SET a = 5 WHERE a = 3;
96+
delimiter //;
97+
CREATE DEFINER = noauth@localhost FUNCTION noauthdb.f1() RETURNS INT CONTAINS SQL SQL SECURITY DEFINER
98+
BEGIN
99+
DECLARE outp INT DEFAULT NULL;
100+
SELECT MAX(a) INTO outp FROM noauthdb.t2;
101+
RETURN outp;
102+
END//
103+
delimiter ;//
104+
105+
GRANT SELECT ON noauthdb.v1 TO otheruser@localhost;
106+
GRANT EXECUTE ON noauthdb.* TO otheruser@localhost;
107+
GRANT EXECUTE ON noauthdb.* TO noauth@localhost;
108+
109+
--enable_query_log
110+
111+
--echo # Connect as otheruser - should succeed.
112+
--exec $MYSQL --user=otheruser -e "select user(), current_user(), @@proxy_user; SELECT * FROM noauthdb.v1; CALL noauthdb.p1(); SELECT noauthdb.f1();"
113+
114+
--echo # Attempt to access underlying tables directly using otheruser - should fail.
115+
--error 1, ER_TABLEACCESS_DENIED_ERROR
116+
--exec $MYSQL --user=otheruser -e "SELECT * FROM noauthdb.t1;"
117+
118+
# Cleanup
119+
--disable_query_log
120+
121+
DROP DATABASE noauthdb;
122+
DROP USER noauth@localhost;
123+
DROP USER otheruser@localhost;
124+
125+
#UNINSTALL PLUGIN mysql_no_auth;
126+
--enable_query_log
127+
--exit

‎plugin/auth/CMakeLists.txt‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
1+
# Copyright (c) 2010, 2015 Oracle and/or its affiliates. All rights reserved.
22
#
33
# This program is free software; you can redistribute it and/or
44
# modify it under the terms of the GNU General Public License as
@@ -27,6 +27,9 @@ MYSQL_ADD_PLUGIN(qa_auth_server qa_auth_server.c
2727

2828
MYSQL_ADD_PLUGIN(qa_auth_client qa_auth_client.c
2929
MODULE_ONLY)
30+
31+
MYSQL_ADD_PLUGIN(mysql_no_login mysql_no_login.c
32+
MODULE_ONLY)
3033

3134
CHECK_CXX_SOURCE_COMPILES(
3235
"#ifndef _GNU_SOURCE

‎plugin/auth/mysql_no_login.c‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/* Copyright (c) 2014, 2015 Oracle and/or its affiliates. All rights reserved.
2+
3+
This program is free software; you can redistribute it and/or
4+
modify it under the terms of the GNU General Public License as
5+
published by the Free Software Foundation; version 2 of the
6+
License.
7+
8+
This program is distributed in the hope that it will be useful,
9+
but WITHOUT ANY WARRANTY; without even the implied warranty of
10+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11+
GNU General Public License for more details.
12+
13+
You should have received a copy of the GNU General Public License
14+
along with this program; if not, write to the Free Software
15+
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */
16+
17+
/**
18+
@file
19+
20+
mysql_no_login authentication plugin.
21+
22+
This plugin exists to support system user accounts, which
23+
cannot be accessed externally. This is useful for privileged
24+
stored programs, views and events. Such objects can be created
25+
with DEFINER = [sys account] SQL SECURITY DEFINER.
26+
*/
27+
28+
#include <my_global.h>
29+
#include <mysql/plugin_auth.h>
30+
#include <string.h>
31+
#include <stdio.h>
32+
#include <stdlib.h>
33+
34+
static int mysql_no_login(
35+
MYSQL_PLUGIN_VIO *vio __attribute__((unused)),
36+
MYSQL_SERVER_AUTH_INFO *info __attribute__((unused)))
37+
{
38+
return CR_ERROR;
39+
}
40+
41+
static struct st_mysql_auth mysql_no_login_handler=
42+
{
43+
MYSQL_AUTHENTICATION_INTERFACE_VERSION,
44+
0,
45+
mysql_no_login
46+
};
47+
48+
mysql_declare_plugin(mysql_no_login)
49+
{
50+
MYSQL_AUTHENTICATION_PLUGIN, /* type constant */
51+
&mysql_no_login_handler, /* type descriptor */
52+
"mysql_no_login", /* Name */
53+
"Todd Farmer", /* Author */
54+
"No login authentication plugin", /* Description */
55+
PLUGIN_LICENSE_GPL, /* License */
56+
NULL, /* Init function */
57+
NULL, /* Deinit function */
58+
0x0100, /* Version (1.0) */
59+
NULL, /* status variables */
60+
NULL, /* system variables */
61+
NULL, /* config options */
62+
0, /* flags */
63+
}
64+
mysql_declare_plugin_end;

0 commit comments

Comments
 (0)