Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-32665

Faking non-existing user during authentication throws confusing "unknown authentication plugin"

    XMLWordPrintable

Details

    Description

      See e.g https://stackoverflow.com/questions/76520710/authentication-plugin-auth-gssapi-client-cannot-be-loaded or https://stackoverflow.com/questions/77266689/sqlx-unknown-authentication-plugin-auth-gssapi-client-mariadb

      Since 10.11 (MDEV-26715), root user can connect using gssapi, e.g if password not provided.

      GSSAPI is not supported by non-MariaDB Connectors, with one notable exception of community .NET connector (https://mysqlconnector.net ) . This is not a big deal, as we do not expect 3rd party application to use "root" user in applications, and even if they do, with correct password it would work.

      However trying to connect if the user does not exist , and MariaDB "faking" logic copies a root user, that runs authentication sequence, and ends up with "auth_gssapi is not supported".

      This

      • Is, with a high probability, a giveaway for "user does not exist" condition, exactly what faking user logic was aimed to fix

      Perhaps, existing logic should be changed, so predefined users e.g "root" are not used to fake a non-existing user.

      Attachments

        Issue Links

          Activity

            People

              serg Sergei Golubchik
              wlad Vladislav Vaintroub
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.