privilege, server: support LDAP authentication

[YangKeao]

What problem does this PR solve?

Issue Number: close #43580

Problem Summary:

Support LDAP authentication in TiDB.

What is changed and how it works?

1. Allow creating users identified with ldap.
2. Authenticate through binding with LDAP server, with simple method or SASL method.

This PR has some know issues, and will be fixed in the following PR:

1. If the LDAP connection timeout (or killed by the server), it'll not be released or re-initialized.
2. The LDAP connection pool is not automatically scaled, so the variable authentication_ldap_{simple,sasl}_max_pool_size has no meaning. Maybe we should use a single authentication_ldap_{simple,sasl}_pool_size variable to replace init and max pool size, if we don't support auto scaling? I'm not sure whether it's needed actually.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No code

Here is the guide for manually test:

Manual Test Instruction

Here is a guide to manually test the following functions. To help the reviewer test this function, I have prepared a docker image to setup the LDAP server environment. It will use port 389 and 3306 to setup a LDAP server and a percona server (as reference). You can execute the following commands and don't exit the shell. It's also suggested to use the mysql client in this docker image, in case that your local mysql client doesn't support LDAP authentication (or don't have related dependencies installed):

docker run --network host -it yangkeao/ldap-sasl-example:d2b324 /bin/bash

To test this PR, you'll need to compile the tidb server and execute it. I assume the TiDB server runs with default configuration and listens port 4000.

Then we need to set some basic variables to make LDAP work:

set global authentication_ldap_sasl_server_host='127.0.0.1';

Simple LDAP authentication

1. Create a user with simple LDAP authentication by executing the following SQL in TiDB server.

create user yangkeao IDENTIFIED WITH authentication_ldap_simple as 'cn=yangkeao+uid=yangkeao,dc=example,dc=org';

2. Try to login the tidb-server with user yangkeao. The password is 123456.

LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1 mysql -h 127.0.0.1 -u yangkeao -P 4000 -p123456

Login successfully. It means the simple LDAP authentication method really works!

LDAP SASL authentication (SCRAM-SHA-1/256)

1. Create a user with SASL LDAP authentication, or alter the previous user to use SASL LDAP authentication:

alter user yangkeao IDENTIFIED WITH authentication_ldap_sasl as 'cn=yangkeao+uid=yangkeao,dc=example,dc=org';

2. Try to login the tidb-server with user yangkeao. As the LDAP SASL method uses authentication_ldap_sasl_client plugin, but not clear_text plugin, so you don't need to enable the clear_text plugin with environment variables:

mysql -h 127.0.0.1 -u yangkeao -P 4000 -p123456

Login successfully. It means the SASL LDAP authentication method really works!

3. You can also change to another SASL method to have a try (the default one is SCRAM-SHA-1). For example:

set global authentication_ldap_sasl_auth_method_name='SCRAM-SHA-256';

4. Then you can login through mysql -h 127.0.0.1 -u yangkeao -P 4000 -p123456, you'll get the same result.

StartTLS

TiDB also support using TLS connection between tidb-server and LDAP server (NOTE: LDAP over SSL is not supported, like MySQL). The CA certificate locates in /etc/ssl/certs/example.crt in the container. You can copy it to anywhere the TiDB server can read. For example, I copied it to /tmp/ca.crt:

cat <<EOF > /tmp/ca.crt
-----BEGIN CERTIFICATE-----
MIIFZTCCA02gAwIBAgIUZ2hQOFVvjuAHrC8Tv+5dnwPGvF0wDQYJKoZIhvcNAQEL
BQAwQjELMAkGA1UEBhMCWFgxFTATBgNVBAcMDERlZmF1bHQgQ2l0eTEcMBoGA1UE
CgwTRGVmYXVsdCBDb21wYW55IEx0ZDAeFw0yMzA0MjQwNjM1MTRaFw0yODA0MjMw
NjM1MTRaMEIxCzAJBgNVBAYTAlhYMRUwEwYDVQQHDAxEZWZhdWx0IENpdHkxHDAa
BgNVBAoME0RlZmF1bHQgQ29tcGFueSBMdGQwggIiMA0GCSqGSIb3DQEBAQUAA4IC
DwAwggIKAoICAQDFvQt3xupYFQxZsyQPr2byhR9ZHoAWBxxqNWxbvpqy7RzHeccJ
Jg36dO1BNIBY8NjIy/JHV7eLDVGCh9FTGozn8dODQMOwDXTYqxFOiBHb2/M9wxVX
ILafa1GlsOnUFxEws9T0XH7ZBqMLC/KlXdJ5xQD1C36K1eWHvphjD0AFhgUnqQ4N
O3NT3tJjzcY7oXBoKpgSgQs7qeTdJLTKJE7pY02C/hJI2WvJDdIiEhZTi0UWqE06
5aXp8Heag/H4VlZzRA+RzQuDXqgXC3Bt7mJwtnoym0HgyTvoKBKO/vzfAW1yQhGo
6ikfSZkvIy3kyPAxD1FSWeSA0Xo8soGNDUsZjV6dQRtcnlWLPFA+7VfwivCPNiFh
91csXhHNEkYPNq4yCe6ZsycydZ+GNdNygzIrMjQ+DjNnHXXmfdeiiLLJbyxYzwuu
GaAT9eD98vXeJFhuWSbKyj4oXcMKnj3bTAQnudMCHIV8cMDe7Zuq1d4/gjXvk95Z
s/OnxqRYYNTXECkdLrevAPfGI2Qg9d7IrhnAh6KqCDDiFkhDkS5TMbWeHA88ZPKZ
6RvLYZmA+j3tjtKPpta9yPiTglExjBUDHIe+37K84G4p0C4bEo5RxEop5hHuX4EW
QvwNb0254i+RCsdyt+tFHiAVzo3/mTg9EMkWlTzoy0381HytFNcLDGb37QIDAQAB
o1MwUTAdBgNVHQ4EFgQUHs+YTH+x0YRNja11v18CF4iu5XowHwYDVR0jBBgwFoAU
Hs+YTH+x0YRNja11v18CF4iu5XowDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
AQsFAAOCAgEAqf2ukpuqXC7u0kTqWdrw+3x2R+mwoLSsy7QbpsjdPbJwVoEysC02
WHiZcMj+w75wZQ2SS5Md1+1K4HiIWC3n+eRDodz+Di0Hg9lxtoMFuOIBpnYUsDuA
Fooo/B7HadZkw9AbWFxPK5EGLyfCRuZF50981svSX5rnYqgCLLs0zGxr7Uswhzvh
3fQMDd0OGLST0M4FW/pQkRYIWnQ4zn/n+wJaHBeaKXHJ7QfgNCtVXOLTXdzpreIL
RvvydcOdVoPnjMgCs1jyhB6g226+/nOuQqic53pxnUTUTvHFJQ5B6/JlzMHeJS1m
ycvSxmF+3RqhjePiwRAT/ui9FBXkhXSG3wp0n0w83rpq7Ne0uwPH/KE9hqFkiI5x
PzobjKy6ahzoSbZrw/a4gDXfZe3fYGtm1EdyDYTh1HFCi7hkdoxY9iCIL1Gr+mpB
YruELQZ+RpvZQ7V8JN7bPtzWfPybPkOSozP1EoLXhUAnXl4/DinoBZvum1MpvPWY
sKF9qQfTP6cAqOuIL1LcVhJ7yHAjR+BK7tvhA2h4sIqxEjhlDmJjH0XMr9JpYQcb
yBzNgkS0YycMPJru0zb2p7vodql5rxSWArQW13Pyqza6N803Qk3vP0/SCfYXeR/i
hv/InNBQBwfHo79FBEv/T7UB8yS7CIu75f562jp23DFKUQD+doybmDg=
-----END CERTIFICATE-----
EOF

Then configure the TiDB to use StartTLS to connect to the LDAP:

set global authentication_ldap_sasl_tls='ON';
set global authentication_ldap_sasl_ca_path='/tmp/ca.crt';

Then you can login the user yangkeao with the StartTLS:

mysql -h 127.0.0.1 -u yangkeao -P 4000 -p123456

NOTE: this certificate is signed for localhost and 127.0.0.1. Using it on other host will refuse to login.

Release note

Support `authentication_ldap_simple` and `authentication_ldap_sasl` authentication plugin. Allow authenticate user with LDAP service.

[ti-chi-bot]

[REVIEW NOTIFICATION]

This pull request has been approved by:

• CbcWestwolf
• bb7133

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Reviewer can indicate their review by submitting an approval review.
Reviewer can cancel approval by submitting a request changes review.

[YangKeao]

This PR is around 300-400 lines. Most of the 1500 lines of changes are refractor (adding arguments to existing functions), system variables, getter/setter, format padding... Though, 300-400 lines are quite large too...

[CbcWestwolf]

LGTM

[CbcWestwolf]

/retest-required

[livepo]

LGTM

[YangKeao]

/retest-required

[bb7133]

LGTM

[bb7133]

/merge

[ti-chi-bot]

This pull request has been accepted and is ready to merge.

Commit hash: 5764079

[ti-chi-bot]

In response to a cherrypick label: new pull request created to branch release-7.1: #43696.