Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-18311

Change default PAM service name to mariadb

Details

    Description

      With the update of the pam authentication plugin from 1.0 to 2.0 in MariaDB 10.4, do we also want to change the default PAM service name from "mysql" to "mariadb"?

      https://github.com/MariaDB/server/blob/efba0b1df5abe1ac972181a01bcbd208693639ae/plugin/auth_pam/auth_pam_base.c#L152

      Attachments

        Issue Links

          is part of

          Epic - Created by Jira Software - do not edit or delete. Issue type for a big user story that needs to be broken down. MDEV-30201 Remove MySQL names

          • Major - Major loss of function.
          • Open
          relates to

          Task - A task that needs to be done. MDEV-7032 new pam plugin with a suid wrapper

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Task - A task that needs to be done. MDEV-15473 Isolate/sandbox PAM modules, so that they can't crash the server

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            serg Sergei Golubchik added a comment -

            may be. But it needs to be carefully done to make sure nothing breaks on upgrades.

            E.g. if there are users that use PAM plugin and PAM service name is not specified, do an update to set the service name to mysql for all existing users.

            Hmm, this will still break new users created to use PAM plugin without a service name.

            serg Sergei Golubchik added a comment - may be. But it needs to be carefully done to make sure nothing breaks on upgrades. E.g. if there are users that use PAM plugin and PAM service name is not specified, do an update to set the service name to mysql for all existing users. Hmm, this will still break new users created to use PAM plugin without a service name.
            GeoffMontee Geoff Montee (Inactive) added a comment -

            What if this change were implemented as a new system variable?

            The new system variable could be called something like "pam_default_service". The PAM service identified by this system variable could be used for any users where plugin='pam', but authentication_string is not set. The system variable's default value in 10.5 could be "mariadb", but if a user relied on the behavior from 10.4 and before, then they could just set this variable's value to "mysql."

            GeoffMontee Geoff Montee (Inactive) added a comment - What if this change were implemented as a new system variable? The new system variable could be called something like "pam_default_service". The PAM service identified by this system variable could be used for any users where plugin='pam', but authentication_string is not set. The system variable's default value in 10.5 could be "mariadb", but if a user relied on the behavior from 10.4 and before, then they could just set this variable's value to "mysql."
            serg Sergei Golubchik added a comment -

            Why should we change it at all? I mean, if we do it, and it breaks authentication on upgrade for some user and that user asks why we've changed it, what should be the answer?

            serg Sergei Golubchik added a comment - Why should we change it at all? I mean, if we do it, and it breaks authentication on upgrade for some user and that user asks why we've changed it, what should be the answer?
            GeoffMontee Geoff Montee (Inactive) added a comment -

            I don't really see any technical reason to change the default PAM service name from mysql to mariadb. I see that change more for the purpose of trying to build MariaDB's branding, and trying to rely less on MySQL's branding. Maybe that reason is not a good enough reason to potentially break authentication for some users after they upgrade.

            I can think of technical reasons to add a new variable like pam_default_service. Some users determine that the system default "password-auth" or "system-auth" PAM services work with MariaDB and meet their requirements, so being able to configure the default PAM service could offer these users more flexibility.

            GeoffMontee Geoff Montee (Inactive) added a comment - I don't really see any technical reason to change the default PAM service name from mysql to mariadb. I see that change more for the purpose of trying to build MariaDB's branding, and trying to rely less on MySQL's branding. Maybe that reason is not a good enough reason to potentially break authentication for some users after they upgrade. I can think of technical reasons to add a new variable like pam_default_service. Some users determine that the system default "password-auth" or "system-auth" PAM services work with MariaDB and meet their requirements, so being able to configure the default PAM service could offer these users more flexibility.
            serg Sergei Golubchik added a comment -

            Let's first establish that we want to do it in the first place. And describe the upgrade procedure here, in the MDEV.

            serg Sergei Golubchik added a comment - Let's first establish that we want to do it in the first place. And describe the upgrade procedure here, in the MDEV.

            People

              Unassigned Unassigned
              GeoffMontee Geoff Montee (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.