Skip to content

Commit 7ebabea

Browse files
vaintroubvaintroub
committed
MDEV-23959 GSSAPI plugin - support AD or local group name , and SIDs on Windows
Support membership tests in SSPI with special prefix form CREATE USER u IDENTIFIED WITH gssapi AS "GROUP:<group_name>" or CREATE USER u IDENTIFIED WITH gssapi AS "SID:<sid>" If user is created as one of the above, after successful SSPI handshake, this will happen 1) If "GROUP:" prefix is used, then <group_name> is translated to SID using LookupAccountName() API 2) SSPI user is checked for SID membership with ImpersonateSecurityContext() and CheckMembership() APIs Note, that it <group>/<sid> do not need strictly to refer to an actual group. Identity test is also supported, e.g "GROUP:<users_name>" or "SID:<user_sid>" will work too. Well-known SIDs (in SDDL syntax) appear to be supported such as "SID:WD" will refer to World/Everyone (== "SID:S-1-1-0") or "SID:BA" will refer to Administrators (== "SID:S-1-5-32-544") In UAC environments, for successful checks against Administrators group, elevation(Run As Administrator) might be necessary, since CheckMembership() needs groups to be marked as enabled in the token group list.
1 parent c310f4c commit 7ebabea

File tree

5 files changed

+294
-45
lines changed

5 files changed

+294
-45
lines changed

‎plugin/auth_gssapi/mysql-test/auth_gssapi/groups.result

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
INSTALL SONAME 'auth_gssapi';
2+
Warnings:
3+
Note 1105 SSPI: using principal name 'localhost', mech 'Negotiate'
4+
CREATE USER 'nosuchgroup' IDENTIFIED WITH gssapi AS 'GROUP:nosuchgroup';
5+
connect(localhost,nosuchuser,,test,MASTER_MYPORT,MASTER_MYSOCK);
6+
connect con1,localhost,nosuchuser,,;
7+
ERROR 28000: Access denied for user 'nosuchuser'@'localhost' (using password: NO)
8+
DROP USER nosuchgroup;
9+
CREATE USER 'nullsid' IDENTIFIED WITH gssapi AS 'SID:S-1-0-0';
10+
connect(localhost,nullsid,,test,MASTER_MYPORT,MASTER_MYSOCK);
11+
connect con1,localhost,nullsid,,;
12+
ERROR 28000: Access denied for user 'nullsid'@'localhost' (using password: NO)
13+
DROP USER nullsid;
14+
CREATE USER 'anonymous' IDENTIFIED WITH gssapi AS 'SID:AN';
15+
connect(localhost,anonymous,,test,MASTER_MYPORT,MASTER_MYSOCK);
16+
connect con1,localhost,anonymous,,;
17+
ERROR 28000: Access denied for user 'anonymous'@'localhost' (using password: NO)
18+
DROP USER anonymous;
19+
CREATE USER 'group_everyone' IDENTIFIED WITH gssapi AS 'GROUP:Everyone';
20+
connect con1,localhost,group_everyone,,;
21+
disconnect con1;
22+
connection default;
23+
DROP USER group_everyone;
24+
CREATE USER 'sid_wd' IDENTIFIED WITH gssapi AS 'SID:WD';
25+
connect con1,localhost,sid_wd,,;
26+
disconnect con1;
27+
connection default;
28+
DROP USER sid_wd;
29+
CREATE USER 'S_1_1_0' IDENTIFIED WITH gssapi AS 'SID:S-1-1-0';
30+
connect con1,localhost,S_1_1_0,,;
31+
disconnect con1;
32+
connection default;
33+
DROP USER S_1_1_0;
34+
CREATE USER 'me_short' IDENTIFIED WITH gssapi AS 'GROUP:GSSAPI_SHORTNAME';
35+
connect con1,localhost,me_short,,;
36+
disconnect con1;
37+
connection default;
38+
DROP USER me_short;
39+
CREATE USER 'me_sid' IDENTIFIED WITH gssapi AS 'SID:MY-SID';
40+
connect con1,localhost,me_sid,,;
41+
disconnect con1;
42+
connection default;
43+
DROP USER me_sid;
44+
UNINSTALL SONAME 'auth_gssapi';

‎plugin/auth_gssapi/mysql-test/auth_gssapi/groups.test

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
source include/windows.inc;
2+
--replace_regex /name '[^']+'/name 'localhost'/
3+
INSTALL SONAME 'auth_gssapi';
4+
5+
6+
# Invalid group name
7+
CREATE USER 'nosuchgroup' IDENTIFIED WITH gssapi AS 'GROUP:nosuchgroup';
8+
replace_result $MASTER_MYSOCK MASTER_MYSOCK $MASTER_MYPORT MASTER_MYPORT;
9+
error ER_ACCESS_DENIED_ERROR;
10+
connect (con1,localhost,nosuchuser,,);
11+
DROP USER nosuchgroup;
12+
13+
# Group with no members, NULL SID
14+
CREATE USER 'nullsid' IDENTIFIED WITH gssapi AS 'SID:S-1-0-0';
15+
replace_result $MASTER_MYSOCK MASTER_MYSOCK $MASTER_MYPORT MASTER_MYPORT;
16+
error ER_ACCESS_DENIED_ERROR;
17+
connect (con1,localhost,nullsid,,);
18+
DROP USER nullsid;
19+
20+
21+
# Anonymous
22+
CREATE USER 'anonymous' IDENTIFIED WITH gssapi AS 'SID:AN';
23+
replace_result $MASTER_MYSOCK MASTER_MYSOCK $MASTER_MYPORT MASTER_MYPORT;
24+
error ER_ACCESS_DENIED_ERROR;
25+
connect (con1,localhost,anonymous,,);
26+
DROP USER anonymous;
27+
28+
29+
# Positive tests
30+
31+
# Everyone group
32+
CREATE USER 'group_everyone' IDENTIFIED WITH gssapi AS 'GROUP:Everyone';
33+
replace_result $MASTER_MYSOCK MASTER_MYSOCK $MASTER_MYPORT MASTER_MYPORT;
34+
connect (con1,localhost,group_everyone,,);
35+
disconnect con1;
36+
connection default;
37+
DROP USER group_everyone;
38+
39+
# Everyone AS well-known SID name
40+
CREATE USER 'sid_wd' IDENTIFIED WITH gssapi AS 'SID:WD';
41+
replace_result $MASTER_MYSOCK MASTER_MYSOCK $MASTER_MYPORT MASTER_MYPORT;
42+
connect (con1,localhost,sid_wd,,);
43+
disconnect con1;
44+
connection default;
45+
DROP USER sid_wd;
46+
47+
# Everyone AS SID S-1-1-0
48+
CREATE USER 'S_1_1_0' IDENTIFIED WITH gssapi AS 'SID:S-1-1-0';
49+
replace_result $MASTER_MYSOCK MASTER_MYSOCK $MASTER_MYPORT MASTER_MYPORT;
50+
connect (con1,localhost,S_1_1_0,,);
51+
disconnect con1;
52+
connection default;
53+
DROP USER S_1_1_0;
54+
55+
replace_result $GSSAPI_SHORTNAME GSSAPI_SHORTNAME;
56+
eval CREATE USER 'me_short' IDENTIFIED WITH gssapi AS 'GROUP:$GSSAPI_SHORTNAME';
57+
replace_result $MASTER_MYSOCK MASTER_MYSOCK $MASTER_MYPORT MASTER_MYPORT;
58+
connect (con1,localhost,me_short,,);
59+
disconnect con1;
60+
connection default;
61+
DROP USER me_short;
62+
63+
64+
replace_result $SID MY-SID;
65+
eval CREATE USER 'me_sid' IDENTIFIED WITH gssapi AS 'SID:$SID';
66+
replace_result $MASTER_MYSOCK MASTER_MYSOCK $MASTER_MYPORT MASTER_MYPORT;
67+
connect (con1,localhost,me_sid,,);
68+
disconnect con1;
69+
connection default;
70+
DROP USER me_sid;
71+
72+
73+
UNINSTALL SONAME 'auth_gssapi';

‎plugin/auth_gssapi/mysql-test/auth_gssapi/suite.pm

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ if ($^O eq "MSWin32")
1414
$fullname =~ s/\\/\\\\/; # SQL escaping for backslash
1515
$ENV{'GSSAPI_FULLNAME'} = $fullname;
1616
$ENV{'GSSAPI_SHORTNAME'} = $ENV{'USERNAME'};
17+
chomp(my $sid = `powershell -Command "([System.Security.Principal.WindowsIdentity]::GetCurrent()).User.Value"`);
18+
$ENV{'SID'} = $sid;
19+
1720
}
1821
else
1922
{

‎plugin/auth_gssapi/server_plugin.cc

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,7 @@
3232
GSSAPI authentication plugin, server side
3333
*/
3434

35-
#ifdef _WIN32
36-
typedef unsigned __int64 my_ulonglong;
37-
#else
3835
typedef unsigned long long my_ulonglong;
39-
#endif
4036

4137
#include <stdlib.h>
4238
#include <mysqld_error.h>

0 commit comments

Comments
 (0)