dialog auth #913
dialog auth #913
Conversation
| @@ -60,6 +60,8 @@ type Config struct { | |||
| MultiStatements bool // Allow multiple statements in one query | |||
| ParseTime bool // Parse time values to time.Time | |||
| RejectReadOnly bool // Reject read-only connections | |||
|
|
|||
| DialogFunc func(byte, string) (string, error) // Optional dialog auth implementation | |||
There was a problem hiding this comment.
This should document what the default behavior is if no dialog auth implementation is provided
| @@ -133,7 +133,7 @@ Valid Values: true, false | |||
| Default: false | |||
| ``` | |||
|
|
|||
| `allowCleartextPasswords=true` allows using the [cleartext client side plugin](http://dev.mysql.com/doc/en/cleartext-authentication-plugin.html) if required by an account, such as one defined with the [PAM authentication plugin](http://dev.mysql.com/doc/en/pam-authentication-plugin.html). Sending passwords in clear text may be a security problem in some configurations. To avoid problems if there is any possibility that the password would be intercepted, clients should connect to MySQL Server using a method that protects the password. Possibilities include [TLS / SSL](#tls), IPsec, or a private network. | |||
| `allowCleartextPasswords=true` allows using the [cleartext client side plugin](http://dev.mysql.com/doc/en/cleartext-authentication-plugin.html) or [dialog plugin](https://mariadb.com/kb/en/library/development-pluggable-authentication/#dialog-client-plugin) if required by an account, such as one defined with the [PAM authentication plugin](http://dev.mysql.com/doc/en/pam-authentication-plugin.html). Sending passwords in clear text may be a security problem in some configurations. To avoid problems if there is any possibility that the password would be intercepted, clients should connect to MySQL Server using a method that protects the password. Possibilities include [TLS / SSL](#tls), IPsec, or a private network. | |||
There was a problem hiding this comment.
The links to dev.mysql.com appear broken to me. Might you be able to fix these?
For example, http://dev.mysql.com/doc/en/cleartext-authentication-plugin.html
redirects me to https://dev.mysql.com/doc/refman/8.0/en/cleartext-authentication-plugin.html
which returns 404 and Page Not Found.
|
Extending the If people want to use an alternate way to build the DSN, they can wrap the mysql.Driver and build their own |
|
@pierresouchay Each user who wants to implement his own authentication method can do it without polluting the |
|
Sorry for the slow response, folks. @dolmen’s approach sounds correct so I’ll close this ancient PR. Thanks everyone for the input! |
Description
This PR adds support for the
dialogauthentication plugin. I cut some corners by leaving theDialogFunc()implementation to the user instead of attempting to load a shared library, but I think this is a good enough start. IfDialogFunc()is not implemented, we simply use whatever password is defined in the DSN.Related to #803.
Checklist