[MXS-2383] Support PAM authentications involving more than simple password exchanges Created: 2019-03-13 Updated: 2021-04-19 Resolved: 2020-08-07 |
|
| Status: | Closed |
| Project: | MariaDB MaxScale |
| Component/s: | Authenticator |
| Affects Version/s: | 2.2.19, 2.3.4 |
| Fix Version/s: | 2.5.2 |
| Type: | New Feature | Priority: | Major |
| Reporter: | Geoff Montee (Inactive) | Assignee: | Esa Korhonen |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Issue Links: |
|
||||||||
| Epic Link: | Security Improvements | ||||||||
| Sprint: | MXS-SPRINT-111, MXS-SPRINT-112 | ||||||||
| Description |
|
The documentation says the following:
Some users would like MaxScale to support PAM authentications that involve more than a single simple password exchange. For example, some PAM configurations require two inputs to login--a regular user-set password, and a 2FA token from a service like Google Authenticator or RSA SecurID. |
| Comments |
| Comment by Esa Korhonen [ 2019-04-01 ] |
|
This would likely be difficult to implement. MaxScale needs to use the information given by the client to log into the backends. A password is straightforward, as it can be used as is. Complicated schemes such the ones mentioned would require that MaxScale has access to these extra services and understands them. We would need specifics to implement them. |
| Comment by Geoff Montee (Inactive) [ 2019-04-01 ] |
|
Hi esa.korhonen,
Why would MaxScale need to "understand" them or worry about the specifics? MariaDB server doesn't "understand" those more complicated PAM services, and it still supports them. The underlying PAM framework handles the implementation of the PAM service. MaxScale and MariaDB Server just need to be able to ask the user for some kind of password, token, or whatever the user input is in the scenario when PAM asks for it, and MaxScale and MariaDB Server need to be able to handle PAM asking for more than one password, token, or whatever the user input is in the scenario. Maybe MaxScale needs to implement some form of the dialog callback? This is what MariaDB uses to get user input when PAM authentication is involved: https://mariadb.com/kb/en/library/development-pluggable-authentication/#dialog-client-plugin https://mariadb.com/kb/en/library/authentication-plugin-pam/#dialog-plugin-for-clients |