Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41061

Require Multiple Authentication Plugins Concurrently - MFA

    XMLWordPrintable

Details

    Description

      Ability to require multiple authentication steps concurrently for specific users, the compliment of the new OR logic, for example, forcing a user to log in with both Unix Socket and mysql_native_password together to be able to start a session:

      CREATE USER root@localhost IDENTIFIED VIA unix_socket AND mysql_native_password;
      

      Update 1. Currently, we do not plan to support mix of AND and OR for the same user is not supported, for simplicity

      Update 2. markus makela points out that MySQL multi-factor authentication supports multiple different passwords, and there are client CLI options supporting it (--password2, --password3). That would require some protocol overhaul, as well as support for multiple passwords in all connectors. At first, we can either support at most one password based plugin, for multifactor, or else require that all passwords are the same - but, SET PASSWORD won't probably work as desired.

      Attachments

        Issue Links

          Activity

            People

              serg Sergei Golubchik
              juan.vera Juan (Inactive)
              Votes:
              1 Vote for this issue
              Watchers:
              11 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - 5d Original Estimate - 5d
                  5d
                  Remaining:
                  Time Spent - 30.5d Remaining Estimate - 1d
                  1d
                  Logged:
                  Time Spent - 30.5d Remaining Estimate - 1d
                  30.5d

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.