[CONJ-164] Java client library does not support 'dialog' plugin. Created: 2015-06-29  Updated: 2016-05-23  Resolved: 2016-05-23

Status: Closed
Project: MariaDB Connector/J
Component/s: Other
Affects Version/s: 1.1.9
Fix Version/s: 1.4.0

Type: Bug Priority: Major
Reporter: Eric Burgueno Assignee: Diego Dupin
Resolution: Fixed Votes: 1
Labels: None
Environment:

On the Client: Windows 7 x64, Geneious, mariadb-java-client-1.1.9.jar
On the Server: CentOS 6.6, MariaDB-server 5.5.42, using PAM authentication

Attachments: PNG File connection settings.png    
Issue Links:
Relates
relates to MDEV-8690 include dialog_examples.so in mariadb... Closed

 Description   

The java client library is unable to authenticate against a server using PAM authentication for the user. The error is:

"An error occurred while connecting this account: Client does not support authentication protocol requested by server; consider upgrading MariaDB client"

This may or not be related to CONJ-129

How to reproduce:
1. Install, enable, and configure the pam plugin:

[root]# cat >/etc/pam.d/mariadb <<EOF
auth required pam_unix.so
account required pam_unix.so
EOF

MariaDB [(none)]> install plugin pam soname 'auth_pam.so';
Query OK, 0 rows affected (0.00 sec)

2. Create a database and user:

[root]# echo 'testusr:$6$ThDum2kp$Qkwr/72qEalUsqCdM.SsjbJJnnX7OCxHnMgjEhAq4rTmeXwXW0dLWxDcCkoVRS8GyNZgIHtaEReJaUK4hdNMV/:13306:13306::/home/testusr:/bin/bash' >>/etc/passwd

MariaDB [(none)]> create database `testdbpam`;
MariaDB [(none)]> grant all privileges on `testdbpam`.* to testusr@'%' identified via pam using 'mariadb';

[root]# mysql -u testusr -pabcdef

3. Attempt to connect from a client application using the java-client.jar library. In our case we are getting this error with Geneious, a genome annotation tool.

 Comments   
Comment by Daniel Black [ 2015-07-16 ]

patch: https://github.com/MariaDB/mariadb-connector-j/pull/22 (branched from CONJ-129 as it was required).

one critical bit is missing. The dialog will fill in the password if it matches the exact pam text however a callback is needed to fully implement the dialog client extension because PAM could ask for any number of things.

I don't know enough about the global outer working of JDBC to be able to recommend this. Do we just launch a modal dialog if no callback is registered?

Comment by Diego Dupin [ 2015-07-16 ]

I will check with the implementation of connector/c and ODBC.
On first thought, 1 step auth is ok, 2 step auth make no sense with a non interractive things like the connector.

edit : to be more precise : 1 step auth is ok ... but to be done. (i will check the pull request you've submitted tomorrow daniel)

Comment by Daniel Black [ 2015-07-16 ]

Just had fun merging in your HA/Failover commits

The dialog prompts come directly from PAM as things for dialog ( https://github.com/MariaDB/server/blob/10.1/plugin/auth_pam/auth_pam.c#L73 ) so I don't easy an easy way around this. If people grant interactive users I suspect its meant to be be used. Of course nothing prevents a callback from caching these prompts/values or the server rejecting those cached values.

The c implementation does a prompt - https://github.com/MariaDB/mariadb-connector-c/blob/master/plugins/auth/dialog.c

Comment by Daniel Black [ 2015-07-17 ]

Had a bit of a look. https://dev.mysql.com/doc/connector-j/en/connector-j-using-pam.html uses mysql_clear_password is what I assume the same way as I have. It doesn't seem to support the more complicated dialog that two_questions/three_attempts do in https://mariadb.com/kb/en/mariadb/development-pluggable-authentication/.

Looking at https://dev.mysql.com/doc/connector-j/en/connector-j-reference-configuration-properties.html it has an semi api defined by defaultAuthenticationPlugin ( com.mysql.jdbc.authentication.MysqlNativePasswordPlugin) which might be the way to proceed with client authentication plugins.

Seems defining factory classes as urls args is a consistent way to implement JDBC extensions so one could be defined for the dialog. Perhaps having a constructor of the URL and a getValue(boolean echo, String prompt) interface.

Comment by Diego Dupin [ 2016-05-23 ]

PLUGIN authentication like "PAM authentication" has been implemented in 1.4.0.

Generated at Thu Feb 08 03:13:38 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.