Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-33387

Require Multiple Authentication Plugins Concurrently - MFA

    XMLWordPrintable

Details

    Description

      Ability to require multiple authentication steps concurrently for specific users, the compliment of the new OR logic, for example, forcing a user to log in with both Unix Socket and mysql_native_password together to be able to start a session:

      CREATE USER root@localhost IDENTIFIED VIA unix_socket AND mysql_native_password;
      

      Update 1. Currently, we do not plan to support mix of AND and OR for the same user is not supported, for simplicity

      Update 2. markus makela points out that MySQL multi-factor authentication supports multiple different passwords, and there are client CLI options supporting it (--password2, --password3). That would require some protocol overhaul, as well as support for multiple passwords in all connectors. At first, we can either support at most one password based plugin, for multifactor, or else require that all passwords are the same - but, SET PASSWORD won't probably work as desired.

      Attachments

        Issue Links

          Activity

            People

              wlad Vladislav Vaintroub
              juan.vera Juan
              Votes:
              1 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.