(#3243) Pass authstring (password_hash) for plugins in mysql_user

[jhriggs]

Various authentication plugins use the authentication string to pass additional settings (e.g. CREATE USER <user>@<host> IDENTIFIED WITH <plugin> AS <plugin_settings>). The mysql_user provider currently only passes this data for sha256_password. This change passes the authentication string for all plugins when specified.

This should allow, for example:

# Percona's auth_pam or auth_pam_compat:
mysql_user { 'foo@localhost':
  ensure        => present,
  password_hash => 'mysql, root=developer, users=data_entry',
  plugin        => 'auth_pam_compat',
  tls_options   => 'SSL',
}

# MySQL Enterprise's authentication_pam:
mysql_user { 'bar@localhost':
  ensure        => present,
  password_hash => 'mysql, root=developer, users=data_entry',
  plugin        => 'authentication_pam',
  tls_options   => 'SSL',
}

[jhriggs]

Any takers on this PR? It is a pretty innocuous change to the code for a much-needed feature.

[hunner]

This would be great! Would you be able to supply some examples for the README.md as well? And if possible an acceptance test would be great though if you have real-world examples of plugins being used that we could turn into acceptance tests ourselves that would be helpful as well.

[hunner]

Just eyeballing it, but it looks like this removes validation for accidentally passing in non-hash passwords, which could cause confusion later down the road. Perhaps the validation should still be performed unless @resource[:plugin] == 'sha256_password'?

[hunner]

According to the docs https://dev.mysql.com/doc/refman/5.7/en/create-user.html the forms are IDENTIFIED WITH auth_plugin BY 'auth_string' and IDENTIFIED WITH auth_plugin AS 'hash_string'

Your pull request only uses the AS keyword so I'm guessing is still hashed, but the example you gave in the description is not hashed. Should they be?

Would it make more sense to introduce an auth_string parameter for strings other than password hashes?

[david22swan]

@jhriggs Apologies but due to the amount of time that has gone by without you responding to the above requested changes we feel that we must close this PR. If in the future you wish to continue on this work we will of course be happy to review it once again.
Best Wishes