Skip to content

Conversation

KJTsanaktsidis
Copy link

Description

When using a temporary credential system for MySQL, for example IAM database authenticaiton on AWS or the Database secret backend for Hashicorp Vault, it may not be the case that the same username and password be used for opening every connection in a sql.DB.

This PR adds funcionality whereby the caller can, instead of specifying cfg.User and cfg.Passwd (or in the DSN as user:pass@...), specify a credentialProvider= argument which refers to a callback registered with RegisterCredentialProvider.

When a new connection is to be opened, if the CredentialProvider callback is specified, that is called to obtain a username/password pair rather than using the values from the DSN.

We need this in order to use it with IAM database authentication for Aurora. With IAM database authentication, the "password" you use to connect is in fact a signed token generated with https://docs.aws.amazon.com/sdk-for-go/api/service/rds/rdsutils/#BuildAuthToken. However, the token is signed with an expiry of 15 minutes; so, if a sql.DB is constructed with such a token as the password, the database driver will fail to open any new connections after 15 minutes. By allowing a callback to be used to generate the password, we can re-sign it each time, so that it stays valid.

Although the AWS Aurora usecase only requires changing the password, I suspect some users of the database secrets engine in Hashicorp vault (https://www.vaultproject.io/docs/secrets/databases/mysql-maria.html) will find it useful to be able to change the username as well; Vault works by creating temporary users in the database, so when they expire, vault deletes the actual users out of MySQL and replaces it with one named differently. So this usecase would require being able to change the username in the callback as well as the password.

Anyway, keen to get some 👀 on this and see if people think this would be a useful addition to the library!

Checklist

  • Code compiles correctly
  • Created tests which fail without the change (if possible)
  • All tests passing
  • Extended the README / documentation, if necessary
  • Added myself / the copyright holder to the AUTHORS file

@KJTsanaktsidis KJTsanaktsidis force-pushed the ktsanaktsidis/credential_provider branch from 269e10c to ecdfc32 Compare December 15, 2019 11:33
When using a temporary credential system for MySQL, for example IAM
database authenticaiton on AWS or the Database secret backend for
Hashicorp Vault, it may not be the case that the same username and
password be used for opening every connection in a *sql.DB.

This PR adds funcionality whereby the caller can, instead of specifying
cfg.User and cfg.Passwd (in the DSN as user:pass@...), specify a
CredentialProvider= arguemnt which refers to a callback registered with
RegisterCredentialProvider.

When a new connection is to be opened, if the CredentialProvider
callback is specified, that is called to obtain a username/password pair
rather than using the values from the DSN.
@KJTsanaktsidis KJTsanaktsidis force-pushed the ktsanaktsidis/credential_provider branch from ecdfc32 to 33d6e68 Compare December 15, 2019 11:54
@KJTsanaktsidis
Copy link
Author

Apologies - apparently go modules really doesn't like branches with slashes in them, so I can't actually use this branch to test out my changes in another project. So I'm closing this and opening #1042 with a better branch name on my end.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant