mysql_user.present with - password: null Should Clear the Password for the User

[kevinastone]

Right now, mysql.user_exists accepts password=None which skips checking the password when None, preventing the system from clearing passwords already set on a user.

[basepi]

We'll look into this. Thanks!

[terminalmage]

@kevinastone I've added the ability to clear the password in #6173. The usage for this would be to omit both the password and password_hash options from your mysql_user.present state, and add a new allow_passwordless option, like so:

foo:
  mysql_user.present:
    - allow_passwordless: True

[kevinastone]

Thanks. This creates a bit of a special case though that I was trying to avoid since these database parameters are stored in pillars. It would be easier for the password of null to be passed through correctly.

db-user:
    mysql_user.present:
        - name: {{ pillar["db"]["user"] }}
        - password: {{ pillar["db"]["password"] }}
        - host: '%'

Your implementation requires some Jinja trickery:

db-user:
    mysql_user.present:
        - name: {{ pillar["db"]["user"] }}
        {% if not pillar['db']['password'] %}
        - allow_passwordless: true
        {% else %}
        - password: {{ pillar["db"]["password"] }}
        {% endif %}
        - host: '%'

[terminalmage]

Well, for the sake of security, I felt it was important to force a passwordless login to be an intentional action.

[kevinastone]

Okay, but let's make allow_passwordless a flag and not an override of password. That way, I can always specify allow_passwordless: true and it will either set an empty password or a real password based on the pillar data.

+    if password:
+        qry += ' AND Password = PASSWORD(\'{0}\')'.format(password)
+    elif salt.utils.is_true(passwordless):
+        qry += ' AND Password = \'\''

[terminalmage]

It's not an override. That bit of code you're referencing is from the mysql.user_exists function. It's not changing anything, it's merely checking to see if there is user for the specified host with an empty password.

If you look at the mysql_user state in my pull request, specifically this chunk, it should be pretty clear that allow_passwordless is a flag. It defaults to False, but it can be set to True and will still let you set a password if neither a password nor a hash has been specified.