Support user management commands

[ferretdb-bot]

FerretDB should manage users by itself and not rely on the backend to do that:

• FerretDB should store credentials in the admin.system.users collection;
• FerretDB should enforce authentication (check passed username and password against stored) itself;
• FerretDB should not change the backend connection string (PostgreSQL URI, etc) it was started with;
• FerretDB should not create users in the backend.

Among other things, this feature is required for some authentication mechanisms like SCRAM-SHA-256, which in turn is needed for some applications and drivers.

Note that this issue covers authentication only; authorization is #174.

Links

SASL / SCRAM

• Overview: https://www.cockroachlabs.com/docs/dev/security-reference/scram-authentication
• SASL: https://www.rfc-editor.org/rfc/rfc4422.html
• SCRAM: https://www.rfc-editor.org/rfc/inline-errata/rfc5802.html
• SCRAM-SHA-256: https://www.rfc-editor.org/rfc/rfc7677.html

PLAIN

• https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
• https://www.ietf.org/archive/id/draft-ietf-kitten-password-storage-04.html
• https://www.rfc-editor.org/rfc/rfc9106.html
• https://pkg.go.dev/golang.org/x/crypto/argon2

---

Tasks

Beta Give feedback

1. Implement createUser command #1491
   area/auth code/feature +2
   
2. Implement dropUser command #1493
   area/auth code/feature +2
   
3. Implement usersInfo command #1497
   area/auth code/feature +2
   
4. Implement dropAllUsersFromDatabase command #1492
   area/auth code/feature +2
   
5. Store passwords for PLAIN authentication mechanism #3785
   area/auth code/chore +2
   
6. Use PBKDF2 for storing password for PLAIN authentication method #3938
   area/auth code/chore not ready +3
7. Implement updateUser command #1496
   area/auth code/feature +2
   
8. Add tests for SCRAM-SHA-1 and SCRAM-SHA-256 dance#681
   code/chore +1
   
9. Support SCRAM-SHA-256 authentication mechanism #3784
   area/auth code/chore +2
   
10. Support SCRAM-SHA-1 authentication mechanism #2012
    area/auth code/feature not ready +3
    
11. Support speculativeAuthenticate #3777
    area/auth code/chore not ready +3
    
12. Enforce new authentication #1877
    area/auth code/chore +2
    
13. Implement localhost exception #4100
    code/chore not ready +2
    
14. Support authentication for SQLite #3008
    area/auth backend/sqlite code/feature not ready +4
    
15. Support saslSupportedMechs #3778
    area/auth code/chore +2
    
16. Prevent logging of secret values #3786
    area/observability code/chore not ready +3
    
17. Enable new authentication by default #3944
    area/auth code/chore not ready +3
    
18. Logout user if they are removed or their password updated
19. Drop SCRAM package?

• Update listCommands to include requiresAuth.
• Update connectionStatus to include authInfo.