Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add support for ed25519 password plugin in mysql_user #672

Closed
hubiongithub opened this issue Sep 3, 2024 · 4 comments · Fixed by #674 or #676
Closed

add support for ed25519 password plugin in mysql_user #672

hubiongithub opened this issue Sep 3, 2024 · 4 comments · Fixed by #674 or #676

Comments

@hubiongithub
Copy link
Contributor

Followup to
#6

SUMMARY

add ed25519 plugin support in mysql_user

ISSUE TYPE

allow user to create and alter mariadb user with ed25519 plugin

COMPONENT NAME

mysql_user, module_utils/user.py

ADDITIONAL INFORMATION

https://mariadb.com/kb/en/create-user/#identified-viawith-authentication_plugin

in v3.10.0 this starts at line 214:
        # Mysql and MariaDB differ in naming pam plugin and Syntax to set it
        if plugin in ('pam'):  # Used by MariaDB which requires the USING keyword, not BY
            query_with_args = "CREATE USER %s@%s IDENTIFIED WITH %s USING %s", (user, host, plugin, plugin_auth_string)
        elif plugin in ('ed25519'):  # Used by MariaDB which requires the USING keyword, not BY
            query_with_args = "CREATE USER %s@%s IDENTIFIED WITH %s USING PASSWORD(%s)", (user, host, plugin, plugin_auth_string)
        elif salt:            

and this at line 400:
                    # Mysql and MariaDB differ in naming pam plugin and syntax to set it
                    if plugin in ('pam'):                                                
                        query_with_args = "ALTER USER %s@%s IDENTIFIED WITH %s USING %s", (user, host, plugin, plugin_auth_string)
                    elif plugin in ('ed25519'):                                                
                        query_with_args = "ALTER USER %s@%s IDENTIFIED WITH %s USING PASSWORD(%s)", (user, host, plugin, plugin_auth_string)
                    elif salt:

According to the mentioned mariadb documentation, pam is using the "plugin_auth_string" as a string to identify the pam service
and ed25519 needs a hash or a cleartext password in the PASSWORD(%s) call. above code only works for the later one.
I tested these with ansible code like this:

- name: Create User
      community.mysql.mysql_user:
        name: "{{ user_monitoring }}"
        plugin: "ed25519"
        plugin_auth_string: "{{ user_monitoring_pw }}"
        update_password: "on_create"
        priv: 'monitoring.*:ALL/*.*:REPLICATION SLAVE ADMIN,SLAVE MONITOR'
        host: "{{ item }}"
        resource_limits:
          MAX_USER_CONNECTIONS: 10
        tls_requires:
          ssl:
        state: present
      with_items:
        - "localhost"
@Andersson007
Copy link
Collaborator

@hubiongithub i've just released 3.10.2 with the fix - can be installed via ansible-galaxy now or will appear in the ansible package in it's next minor release, thanks for the contribution!

@hubiongithub
Copy link
Contributor Author

@Andersson007
I installed 3.10.2 but this does not have the mentioned changes,
https://github.com/ansible-collections/community.mysql/pull/674/files
only has the ed25519 part in the "update" section and do not use the USING PASSWORD(%s) syntax.

@Andersson007
Copy link
Collaborator

@hubiongithub thanks for the feedback, I see it in two places now (downloaded the 3.10.2 archive associated with the tag), isn't it how it was supposed to be? You could edit the file yourself in this web ui and submit a PR directly from that view. If you do it directly, i think it'd be more effective:) I can't test this stuff locally

@hubiongithub
Copy link
Contributor Author

@Andersson007
I hope I filled everything in Update user.py #676

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants