|
While lack of this feature isn't critical for deploying in our environment, it makes management much more difficult. Currently all of our users are auth'd via pam+ldap to our AD domain. We only have a couple of DB admins, so no big deal in production, but on the development side, we have many developers that need access to the development DB's to allow query analisys, index creation, etc. Since we adhere to most banking regulations regarding security of DBs, files, etc, we require frequent password changes. Since we currently have no method of syncing a password change to the DB users, we have to depend on the users to change the passwords on the DB servers themselves, not an ideal situation to say the least.
|
|
Adding a PAM authentication plugin similar to the one on the server to MaxScale should be possible. This would allow the client (assuming the client UI/command line supports PAM communication) to login to MaxScale. However, after this MaxScale needs to login to the backend servers using the client's username while the host machine changes from the client machine to the MaxScale machine. This MaxScale-to-backend login must be doable autonomously. Also, contrary to a normal sql login, MaxScale would have no other information about the user other than the username.
Here are some possibilities for the backend login:
1) Each backend allows MaxScale to login without a password for select users. Unsecure.
2) We implement a new PAM plugin that would run on the backends. This plugin would contact the MaxScale machine and ask if the user is currently logged in and accept the login if that is the case. Would require using non-standard PAM-plugins on the server.
3) Could the MaxScale machine obtain a token for the user from the ldap server and use that to login? Or could the backends check from ldap that the user is logged in and accept his login from MaxScale-IP? My knowledge on ldap is superficial, so I don't know if these are possible.
In any case, more information on what would MaxScale actually need to do is required to implement PAM support. JWSmith
|