Skip to content

Commit

Permalink
privilege, server: support LDAP authentication (#43582) (#43696)
Browse files Browse the repository at this point in the history 
close #43580
  • Loading branch information
@ti-chi-bot
ti-chi-bot committed May 11, 2023
1 parent 463759e commit 00b50a3
Show file tree
Hide file tree
Showing 73 changed files with 1,606 additions and 514 deletions.
36 changes: 34 additions & 2 deletions DEPS.bzl
View file
Expand Up @@ -111,6 +111,13 @@ def go_deps():
sum = "h1:4QctJBgXEkbzeKz6PJy6bt3JSPNSN4I2mITYW+eKUoQ=",
version = "v1.0.0",
)
go_repository(
name = "com_github_alexbrainman_sspi",
build_file_proto_mode = "disable",
importpath = "github.com/alexbrainman/sspi",
sum = "h1:Kk6a4nehpJ3UuJRqlA3JxYxBZEqCeOmATOvrbT4p9RA=",
version = "v0.0.0-20210105120005-909beea2cc74",
)

go_repository(
name = "com_github_alexkohler_prealloc",
Expand Down Expand Up @@ -294,6 +301,14 @@ def go_deps():
sum = "h1:Q2feRPMlcfVcqz3pF87PJzkm5lZrL+x6BDtzhODzNJM=",
version = "v11.2.8+incompatible",
)
go_repository(
name = "com_github_azure_go_ntlmssp",
build_file_proto_mode = "disable",
importpath = "github.com/Azure/go-ntlmssp",
sum = "h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=",
version = "v0.0.0-20221128193559-754e69321358",
)

go_repository(
name = "com_github_bazelbuild_buildtools",
build_file_proto_mode = "disable",
Expand Down Expand Up @@ -1217,6 +1232,14 @@ def go_deps():
sum = "h1:3tMoCCfM7ppqsR0ptz/wi1impNpT7/9wQtMZ8lr1mCQ=",
version = "v1.4.0",
)
go_repository(
name = "com_github_go_asn1_ber_asn1_ber",
build_file_proto_mode = "disable",
importpath = "github.com/go-asn1-ber/asn1-ber",
sum = "h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A=",
version = "v1.5.4",
)

go_repository(
name = "com_github_go_check_check",
build_file_proto_mode = "disable_global",
Expand Down Expand Up @@ -1282,6 +1305,15 @@ def go_deps():
sum = "h1:MRVx0/zhvdseW+Gza6N9rVzU/IVzaeE1SFI4raAhmBU=",
version = "v0.2.1",
)
go_repository(
name = "com_github_go_ldap_ldap_v3",
build_file_proto_mode = "disable",
importpath = "github.com/go-ldap/ldap/v3",
replace = "github.com/YangKeao/ldap/v3",
sum = "h1:+OqGGFc2YHFd82aSHmjlILVt1t4JWJjrNIfV8cVEPow=",
version = "v3.4.5-0.20230421065457-369a3bab1117",
)

go_repository(
name = "com_github_go_logfmt_logfmt",
build_file_proto_mode = "disable_global",
Expand Down Expand Up @@ -1372,8 +1404,8 @@ def go_deps():
name = "com_github_go_sql_driver_mysql",
build_file_proto_mode = "disable_global",
importpath = "github.com/go-sql-driver/mysql",
sum = "h1:ueSltNNllEqE3qcWBTD0iQd3IpL/6U+mJxLkazJ7YPc=",
version = "v1.7.0",
sum = "h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=",
version = "v1.7.1",
)
go_repository(
name = "com_github_go_stack_stack",
Expand Down
4 changes: 2 additions & 2 deletions bindinfo/bind_test.go
View file
Expand Up @@ -762,11 +762,11 @@ func TestPrivileges(t *testing.T) {
tk.MustExec("drop table if exists t")
tk.MustExec("create table t(a int, b int, index idx(a))")
tk.MustExec("create global binding for select * from t using select * from t use index(idx)")
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
rows := tk.MustQuery("show global bindings").Rows()
require.Len(t, rows, 1)
tk.MustExec("create user test@'%'")
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "test", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "test", Hostname: "%"}, nil, nil, nil))
rows = tk.MustQuery("show global bindings").Rows()
require.Len(t, rows, 0)
}
Expand Down
38 changes: 19 additions & 19 deletions bindinfo/capture_test.go
View file
Expand Up @@ -64,7 +64,7 @@ func TestDMLCapturePlanBaseline(t *testing.T) {
rows := tk.MustQuery("show global bindings").Rows()
require.Len(t, rows, 0)

require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("delete from t where b = 1 and c > 1")
tk.MustExec("delete from t where b = 1 and c > 1")
tk.MustExec("update t set a = 1 where b = 1 and c > 1")
Expand Down Expand Up @@ -111,7 +111,7 @@ func TestCapturePlanBaseline(t *testing.T) {
rows := tk.MustQuery("show global bindings").Rows()
require.Len(t, rows, 0)

require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("select * from t where a > 10")
tk.MustExec("select * from t where a > 10")
tk.MustExec("admin capture bindings")
Expand Down Expand Up @@ -143,7 +143,7 @@ func TestCapturePlanBaseline4DisabledStatus(t *testing.T) {
rows := tk.MustQuery("show global bindings").Rows()
require.Len(t, rows, 0)

require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("select * from t where a > 10")
tk.MustExec("select * from t where a > 10")
tk.MustExec("admin capture bindings")
Expand Down Expand Up @@ -191,7 +191,7 @@ func TestCaptureDBCaseSensitivity(t *testing.T) {
tk.MustExec("use SPM")
tk.MustExec("create table t(a int, b int, key(b))")
tk.MustExec("create global binding for select * from t using select /*+ use_index(t) */ * from t")
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("select /*+ use_index(t,b) */ * from t")
tk.MustExec("select /*+ use_index(t,b) */ * from t")
tk.MustExec("admin capture bindings")
Expand All @@ -217,7 +217,7 @@ func TestCaptureBaselinesDefaultDB(t *testing.T) {
tk.MustExec("drop database if exists spm")
tk.MustExec("create database spm")
tk.MustExec("create table spm.t(a int, index idx_a(a))")
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("select * from spm.t ignore index(idx_a) where a > 10")
tk.MustExec("select * from spm.t ignore index(idx_a) where a > 10")
tk.MustExec("admin capture bindings")
Expand All @@ -244,7 +244,7 @@ func TestCapturePreparedStmt(t *testing.T) {
tk := testkit.NewTestKit(t, store)

stmtsummary.StmtSummaryByDigestMap.Clear()
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("use test")
tk.MustExec("drop table if exists t")
tk.MustExec("create table t(a int, b int, c int, key idx_b(b), key idx_c(c))")
Expand Down Expand Up @@ -279,7 +279,7 @@ func TestCapturePlanBaselineIgnoreTiFlash(t *testing.T) {
tk.MustExec("use test")
tk.MustExec("drop table if exists t")
tk.MustExec("create table t(a int, b int, key(a), key(b))")
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("select * from t")
tk.MustExec("select * from t")
// Create virtual tiflash replica info.
Expand Down Expand Up @@ -354,7 +354,7 @@ func TestBindingSource(t *testing.T) {
tk.MustExec("SET GLOBAL tidb_capture_plan_baselines = off")
}()
tk.MustExec("use test")
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("select * from t ignore index(idx_a) where a < 10")
tk.MustExec("select * from t ignore index(idx_a) where a < 10")
tk.MustExec("admin capture bindings")
Expand All @@ -374,7 +374,7 @@ func TestCapturedBindingCharset(t *testing.T) {
tk := testkit.NewTestKit(t, store)

stmtsummary.StmtSummaryByDigestMap.Clear()
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("use test")
tk.MustExec("create table t(name varchar(25), index idx(name))")

Expand Down Expand Up @@ -407,7 +407,7 @@ func TestConcurrentCapture(t *testing.T) {
tk.MustExec("use test")
tk.MustExec("drop table if exists t")
tk.MustExec("create table t(a int, b int)")
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("select * from t")
tk.MustExec("select * from t")
tk.MustExec("admin capture bindings")
Expand All @@ -427,7 +427,7 @@ func TestUpdateSubqueryCapture(t *testing.T) {
tk.MustExec("create table t1(a int, b int, c int, key idx_b(b))")
tk.MustExec("create table t2(a int, b int)")
stmtsummary.StmtSummaryByDigestMap.Clear()
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("update t1 set b = 1 where b = 2 and (a in (select a from t2 where b = 1) or c in (select a from t2 where b = 1))")
tk.MustExec("update t1 set b = 1 where b = 2 and (a in (select a from t2 where b = 1) or c in (select a from t2 where b = 1))")
tk.MustExec("admin capture bindings")
Expand Down Expand Up @@ -481,7 +481,7 @@ func TestIssue20417(t *testing.T) {
stmtsummary.StmtSummaryByDigestMap.Clear()
tk.MustExec("SET GLOBAL tidb_capture_plan_baselines = on")
dom.BindHandle().CaptureBaselines()
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("select * from t where b=2 and c=213124")
tk.MustExec("select * from t where b=2 and c=213124")
tk.MustExec("admin capture bindings")
Expand Down Expand Up @@ -526,7 +526,7 @@ func TestCaptureWithZeroSlowLogThreshold(t *testing.T) {
tk.MustExec("drop table if exists t")
tk.MustExec("create table t(a int)")
stmtsummary.StmtSummaryByDigestMap.Clear()
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("set tidb_slow_log_threshold = 0")
tk.MustExec("select * from t")
tk.MustExec("select * from t")
Expand All @@ -552,7 +552,7 @@ func TestIssue25505(t *testing.T) {
tk.MustExec("create table t (a int(11) default null,b int(11) default null,key b (b),key ba (b))")
tk.MustExec("create table t1 (a int(11) default null,b int(11) default null,key idx_ab (a,b),key idx_a (a),key idx_b (b))")
tk.MustExec("create table t2 (a int(11) default null,b int(11) default null,key idx_ab (a,b),key idx_a (a),key idx_b (b))")
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))

spmMap := map[string]string{}
spmMap["with recursive `cte` ( `a` ) as ( select ? union select `a` + ? from `test` . `t1` where `a` < ? ) select * from `cte`"] =
Expand Down Expand Up @@ -619,7 +619,7 @@ func TestCaptureUserFilter(t *testing.T) {
tk.MustExec("drop table if exists t")
tk.MustExec("create table t(a int)")

require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("select * from t where a > 10")
tk.MustExec("select * from t where a > 10")
tk.MustExec("admin capture bindings")
Expand All @@ -642,7 +642,7 @@ func TestCaptureUserFilter(t *testing.T) {
tk.MustExec(`grant all on *.* to usr1 with grant option`)
tk2 := testkit.NewTestKit(t, store)
tk2.MustExec("use test")
require.NoError(t, tk2.Session().Auth(&auth.UserIdentity{Username: "usr1", Hostname: "%"}, nil, nil))
require.NoError(t, tk2.Session().Auth(&auth.UserIdentity{Username: "usr1", Hostname: "%"}, nil, nil, nil))
tk2.MustExec("select * from t where a > 10")
tk2.MustExec("select * from t where a > 10")
tk2.MustExec("admin capture bindings")
Expand Down Expand Up @@ -707,7 +707,7 @@ func TestCaptureWildcardFilter(t *testing.T) {
tk.MustExec("SET GLOBAL tidb_capture_plan_baselines = off")
}()

require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
dbs := []string{"db11", "db12", "db2"}
tbls := []string{"t11", "t12", "t2"}
for _, db := range dbs {
Expand Down Expand Up @@ -813,7 +813,7 @@ func TestCaptureFilter(t *testing.T) {
tk.MustExec("drop table if exists t")
tk.MustExec("create table t(a int)")

require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("select * from t where a > 10")
tk.MustExec("select * from t where a > 10")
tk.MustExec("admin capture bindings")
Expand Down Expand Up @@ -965,7 +965,7 @@ func TestCaptureHints(t *testing.T) {
tk.MustExec("use test")
tk.MustExec("drop table if exists t")
tk.MustExec("create table t(pk int primary key, a int, b int, key(a), key(b))")
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))

captureCases := []struct {
query string
Expand Down
4 changes: 2 additions & 2 deletions bindinfo/session_handle_test.go
View file
Expand Up @@ -179,7 +179,7 @@ func TestBaselineDBLowerCase(t *testing.T) {
tk.MustExec("create database SPM")
tk.MustExec("use SPM")
tk.MustExec("create table t(a int, b int)")
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("update t set a = a + 1")
tk.MustExec("update t set a = a + 1")
tk.MustExec("admin capture bindings")
Expand Down Expand Up @@ -269,7 +269,7 @@ func TestShowGlobalBindings(t *testing.T) {
tk.MustExec("use SPM")
tk.MustExec("create table t(a int, b int, key(a))")
tk.MustExec("create table t0(a int, b int, key(a))")
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
rows := tk.MustQuery("show global bindings").Rows()
require.Len(t, rows, 0)
// Simulate existing bindings in the mysql.bind_info.
Expand Down
2 changes: 1 addition & 1 deletion br/pkg/lightning/config/config_test.go
View file
Expand Up @@ -783,7 +783,7 @@ func TestLoadConfig(t *testing.T) {
err = taskCfg.Adjust(context.Background())
require.NoError(t, err)
equivalentDSN := taskCfg.Checkpoint.MySQLParam.ToDriverConfig().FormatDSN()
expectedDSN := "guest:12345@tcp(172.16.30.11:4001)/?maxAllowedPacket=67108864&charset=utf8mb4&sql_mode=%27ONLY_FULL_GROUP_BY%2CSTRICT_TRANS_TABLES%2CNO_ZERO_IN_DATE%2CNO_ZERO_DATE%2CERROR_FOR_DIVISION_BY_ZERO%2CNO_AUTO_CREATE_USER%2CNO_ENGINE_SUBSTITUTION%27"
expectedDSN := "guest:12345@tcp(172.16.30.11:4001)/?charset=utf8mb4&sql_mode=%27ONLY_FULL_GROUP_BY%2CSTRICT_TRANS_TABLES%2CNO_ZERO_IN_DATE%2CNO_ZERO_DATE%2CERROR_FOR_DIVISION_BY_ZERO%2CNO_AUTO_CREATE_USER%2CNO_ENGINE_SUBSTITUTION%27"
require.Equal(t, expectedDSN, equivalentDSN)

result := taskCfg.String()
Expand Down
2 changes: 1 addition & 1 deletion ddl/db_cache_test.go
View file
Expand Up @@ -264,7 +264,7 @@ func TestIssue34069(t *testing.T) {
defer sem.Disable()

tk := testkit.NewTestKit(t, store)
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil))
require.NoError(t, tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil))
tk.MustExec("use test;")
tk.MustExec("create table t_34069 (t int);")
// No error when SEM is enabled.
Expand Down
2 changes: 1 addition & 1 deletion ddl/db_integration_test.go
View file
Expand Up @@ -3583,7 +3583,7 @@ func TestAvoidCreateViewOnLocalTemporaryTable(t *testing.T) {
tk := testkit.NewTestKit(t, store)
tk.MustExec("use test")

tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "localhost", CurrentUser: true, AuthUsername: "root", AuthHostname: "%"}, nil, []byte("012345678901234567890"))
tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "localhost", CurrentUser: true, AuthUsername: "root", AuthHostname: "%"}, nil, []byte("012345678901234567890"), nil)
tk.MustExec("drop table if exists tt0")
tk.MustExec("drop table if exists tt1")
tk.MustExec("drop table if exists tt2")
Expand Down
2 changes: 1 addition & 1 deletion ddl/db_test.go
View file
Expand Up @@ -804,7 +804,7 @@ func TestForbidCacheTableForSystemTable(t *testing.T) {
memOrSysDB := []string{"MySQL", "INFORMATION_SCHEMA", "PERFORMANCE_SCHEMA", "METRICS_SCHEMA"}
for _, db := range memOrSysDB {
tk.MustExec("use " + db)
tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil)
tk.Session().Auth(&auth.UserIdentity{Username: "root", Hostname: "%"}, nil, nil, nil)
rows := tk.MustQuery("show tables").Rows()
for i := 0; i < len(rows); i++ {
sysTables = append(sysTables, rows[i][0].(string))
Expand Down
4 changes: 2 additions & 2 deletions ddl/fktest/foreign_key_test.go
View file
Expand Up @@ -305,7 +305,7 @@ func TestCreateTableWithForeignKeyPrivilegeCheck(t *testing.T) {

tk2 := testkit.NewTestKit(t, store)
tk2.MustExec("use test")
tk2.Session().Auth(&auth.UserIdentity{Username: "u1", Hostname: "localhost", CurrentUser: true, AuthUsername: "u1", AuthHostname: "%"}, nil, []byte("012345678901234567890"))
tk2.Session().Auth(&auth.UserIdentity{Username: "u1", Hostname: "localhost", CurrentUser: true, AuthUsername: "u1", AuthHostname: "%"}, nil, []byte("012345678901234567890"), nil)
err := tk2.ExecToErr("create table t2 (a int, foreign key fk(a) references t1(id));")
require.Error(t, err)
require.Equal(t, "[planner:1142]REFERENCES command denied to user 'u1'@'%' for table 't1'", err.Error())
Expand All @@ -330,7 +330,7 @@ func TestAlterTableWithForeignKeyPrivilegeCheck(t *testing.T) {
tk.MustExec("create table t1 (id int key);")
tk2 := testkit.NewTestKit(t, store)
tk2.MustExec("use test")
tk2.Session().Auth(&auth.UserIdentity{Username: "u1", Hostname: "localhost", CurrentUser: true, AuthUsername: "u1", AuthHostname: "%"}, nil, []byte("012345678901234567890"))
tk2.Session().Auth(&auth.UserIdentity{Username: "u1", Hostname: "localhost", CurrentUser: true, AuthUsername: "u1", AuthHostname: "%"}, nil, []byte("012345678901234567890"), nil)
tk2.MustExec("create table t2 (a int)")
err := tk2.ExecToErr("alter table t2 add foreign key (a) references t1 (id) on update cascade")
require.Error(t, err)
Expand Down

0 comments on commit 00b50a3

Please sign in to comment.