I'm actually using MariaDB here, but I'm working under the pretext that MariaDB is a "drop in replacement" for MySQL. I won't be surprised if this winds up being a cross platform difference/issue, but I'm hoping you'd have a look.
Here's the deal: I'm using CentrifyDC for PAM auth with an Active Directory domain. It's working good for SSH/sudoer access, and now I'm trying to hammer out authN/Z for MySQL... err, MariaDB.
User auth appears to work well. I create a user, and it works as intended:
MariaDB [(none)]> grant all privileges on *.* to myuser identified via pam;
For completeness, I'll login and check my grants and who I am:
MariaDB [(none)]> show grants;
+---------------------------------------------------------------+
| Grants for myuser@% |
+---------------------------------------------------------------+
| GRANT ALL PRIVILEGES ON *.* TO 'myuser'@'%' IDENTIFIED VIA pam |
+---------------------------------------------------------------+
1 row in set (0.00 sec)
MariaDB [(none)]> SELECT USER(), CURRENT_USER(), @@proxy_user;
+-----------------+----------------+--------------+
| USER() | CURRENT_USER() | @@proxy_user |
+-----------------+----------------+--------------+
| myuser@localhost | myuser@% | NULL |
+-----------------+----------------+--------------+
1 row in set (0.00 sec)
This looks right to my less-than-expert eye.
Now I'm trying to follow the MySQL documentation at http://dev.mysql.com/doc/refman/5.5/en/pam-authentication-plugin.html, under the heading "6.3.6.2.2.3. Unix Password Authentication with Proxy Users and Group Mapping". This may well be my problem: Following MySQL docs for MariaDB - but I haven't been able to find a MariaDB equivalent. Here's what happens.
Per the docs, I create the proxy user, group, etc... Note that 'myuser' is a member of the group 'my-domain-group'.
CREATE USER ''@'' IDENTIFIED WITH pam as 'mysql, my-doman-group=admin';
CREATE USER 'admin'@'localhost' IDENTIFIED BY 'really weird password';
GRANT ALL PRIVILEGES ON *.* TO 'admin'@'localhost';
GRANT PROXY ON 'admin'@'localhost' to ''@'';
Login as 'myuser' works. Let's check our grants:
MariaDB [(none)]> SHOW GRANTS;
+------------------------------------------------------------------------------------------+
| Grants for @ |
+------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO ''@'' IDENTIFIED VIA pam USING 'mysql, my-doman-group=admin' |
| GRANT PROXY ON 'admin'@'localhost' TO ''@'' |
+------------------------------------------------------------------------------------------+
2 rows in set (0.00 sec)
That's what I would expect to see. Now, according to the docs, let's check who we're proxied as:
MariaDB [(none)]> SELECT USER(), CURRENT_USER(), @@proxy_user;
+-----------------+----------------+--------------+
| USER() | CURRENT_USER() | @@proxy_user |
+-----------------+----------------+--------------+
| myuser@localhost | @ | NULL |
+-----------------+----------------+--------------+
1 row in set (0.00 sec)
So - there we have it. The 'myuser' account isn't getting access from the 'my-domain-group' as it should, but it is allowed access to login. What gives? Any suggestions?