AWS RDS IAM authentication doesn't work because pma_password is truncated

[kamilhristov]

Is your feature request related to a problem? Please describe.

Currently, phpMyAdmin doesn't work with AWS RDS IAM authentication.

The problem is that the temporary token provided by AWS is bigger than 256 symbols.

https://github.com/phpmyadmin/phpmyadmin/blob/master/libraries/classes/Plugins/Auth/AuthenticationCookie.php#L337-L340

Describe the solution you'd like

Would be good if this limit can be changed from config and return an error when the password exceeds the limit.

It is very confusing to silently trim the password.

Is there a reason to trim the password? Maybe don't trim the password at all?

[williamdes]

Ref: https://sourceforge.net/p/phpmyadmin/bugs/4611/
Added by a4e8d00 "bug #4611 [security] DOS attack with long passwords"

cc @MauricioFauth @ibennetch

[ibennetch]

Nice debugging work.

I'm not sure if there's some historical reason this was in place (I suspect that at one time, MySQL passwords were restricted to a particular length and I'm guessing that at the time phpMyAdmin implemented this limit to restrict the ability of an attacker to send a large password that would effectively DOS the server).

As a result, we probably should maintain a limit, but could raise it (perhaps to 1000 characters) and issue an error message instead of silently failing. I agree that this should be improved.

[ibennetch]

Nice research there by @williamdes as well. Thanks.

[williamdes]

Bump to 2000 chars in #18123