Database Automatic User Provisioning support for MariaDB

[greedy52]

Related

• Extend auto user provisioning to support more databases #27323
• Database Automatic User Provisioning support for MySQL #31902
• MySQL auto-user provisioning support for Aurora and version check #32685

changelog: Database Automatic User Provisioning support for MariaDB

Changes:

• Added support db.admin_user.default_database
• Added MariaDB auto-user provisioning stored procedures.
• Enabled MariaDB auto-user provisioning in the engine.

The overall flow is similar to MySQL. Differences are outlined in the comments for mariadbProcedures

Next:

• Docs for auto-user provisioning for MySQL/MariaDB

Tested:

• Self-hosted MariaDB 10.2.11 (older than 10.2.11 are not supported)
• Self-hosted MariaDB 10.3.3 (older than 10.3.3 are not supported)
• Self-hosted MariaDB 10.4.0
• Self-hosted MariaDB 10.7
• Self-hosted MariaDB 11.1
• RDS MariaDB instance 10.11
• Logged in as: a.very.very.very.very.very.very.very.very.very.very.very.very.long.name@teleport.example.com

Test Setup Examples:

Manual testing example with self-hosted MariaDB

1. Configure self-hosted MariaDB

Sample docker instance:
https://github.com/greedy52/teleport-database-test-setup/tree/main/mariadb

Log into the database as the default admin then set up Teleport admin user teleport-admin:

CREATE DATABASE IF NOT EXISTS teleport; -- Default database.
CREATE USER "teleport-admin" REQUIRE SUBJECT "/CN=teleport-admin";
GRANT PROCESS, CREATE USER ON *.* TO 'teleport-admin' ;
GRANT SELECT ON mysql.roles_mapping TO 'teleport-admin' ;
GRANT ALL ON teleport.* TO 'teleport-admin'; -- Allow access to default database.
GRANT UPDATE ON mysql.* TO 'teleport-admin' ; -- Allow SET DEFAULT ROLE FOR.

Create a few roles for testing:

CREATE ROLE role1 WITH ADMIN 'teleport-admin';
CREATE ROLE role2 WITH ADMIN 'teleport-admin';
CREATE ROLE role3 WITH ADMIN 'teleport-admin';
CREATE DATABASE IF NOT EXISTS test;
GRANT SELECT ON test.* to role1;

2. Configure Teleport

Create a Teleport role for auto-user and assign it to your Teleport user, ex:

kind: role
version: v6
metadata:
  name: mysql-auto-user
spec:
  options:
    create_db_user: true
  allow:
    db_labels:
      "Owner": "STeve"
      "teleport.dev/db-admin": "teleport-admin"
    db_names:
    - "*"
    db_roles:
    - "role1"
    - "role3"

Create a static database in Database Service, ex:

db_service:
  enabled: "yes"
  databases:
  - name: "self-hosted-mariadb-auto"
    protocol: "mysql"
    uri: "localhost:3307"
    static_labels:
      Owner: "STeve"
      "teleport.dev/db-admin": "teleport-admin"
    admin_user:
      name: "teleport-admin"

3. Connect

• tsh login
• tsh db connect --db-user <teleport-user> --db-name test self-hosted-mariadb-auto
• select current_user()
• show grants;

Manual testing example with RDS MariaDB

1. Configure RDS MariaDB

Setup a MariaDB instance in AWS RDS, and add tags to the RDS instance:

Tags	Value
Owner	STeve
teleport.dev/db-admin	teleport-admin

Log into the database as the default admin then set up Teleport admin user teleport-admin:

CREATE DATABASE IF NOT EXISTS teleport;  -- Default database.
CREATE USER 'teleport-admin' IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';
GRANT PROCESS, CREATE USER ON *.* TO 'teleport-admin' ;
GRANT SELECT ON mysql.roles_mapping TO 'teleport-admin' ;
GRANT ALL ON teleport.* TO 'teleport-admin'; -- Allow access to default database.
GRANT UPDATE ON mysql.* TO 'teleport-admin' ; -- Allow SET DEFAULT ROLE FOR.

Create a few roles for testing:

CREATE ROLE role1;
CREATE ROLE role2;
CREATE ROLE role3;
UPDATE mysql.roles_mapping SET User ='teleport-admin' WHERE Admin_option='Y' AND Role='role1';
UPDATE mysql.roles_mapping SET User ='teleport-admin' WHERE Admin_option='Y' AND Role='role2';
UPDATE mysql.roles_mapping SET User ='teleport-admin' WHERE Admin_option='Y' AND Role='role3';
CREATE DATABASE IF NOT EXISTS test;
GRANT SELECT ON test.* to role1;
FLUSH PRIVILEGES;

Note that the default admin user in RDS MariaDB does not have permission to do CREATE ROLE role1 WITH ADMIN teleport-admin. The workaround is to update mysql.roles_mapping manually (and then FLUSH PRIVILEGES).

2. Configure Teleport

Create a Teleport role for auto-user and assign it to your Teleport user, ex:

kind: role
version: v6
metadata:
  name: mysql-auto-user
spec:
  options:
    create_db_user: true
  allow:
    db_labels:
      "Owner": "STeve"
      "teleport.dev/db-admin": "teleport-admin"
    db_names:
    - "*"
    db_roles:
    - "role1"
    - "role3"

Use auto-discovery to register the RD MariaDB database.

3. Connect

• tsh login
• tsh db connect --db-user <teleport-user> --db-name test steve-mariadb
• select current_user()
• show grants;

[Tener]

Looks good so far. This is a fairly large change, and the SQL parts are unfamiliar, so I'll do another round on Monday.

[github-actions]

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

[public-teleport-github-review-bot]

@greedy52 See the table below for backport results.

Branch	Result
branch/v14	Failed