1

I'm actually using MariaDB here, but I'm working under the pretext that MariaDB is a "drop in replacement" for MySQL. I won't be surprised if this winds up being a cross platform difference/issue, but I'm hoping you'd have a look.

Here's the deal: I'm using CentrifyDC for PAM auth with an Active Directory domain. It's working good for SSH/sudoer access, and now I'm trying to hammer out authN/Z for MySQL... err, MariaDB.

User auth appears to work well. I create a user, and it works as intended:

MariaDB [(none)]> grant all privileges on *.* to myuser identified via pam;

For completeness, I'll login and check my grants and who I am:

MariaDB [(none)]> show grants;
+---------------------------------------------------------------+
| Grants for myuser@%                                            |
+---------------------------------------------------------------+
| GRANT ALL PRIVILEGES ON *.* TO 'myuser'@'%' IDENTIFIED VIA pam |
+---------------------------------------------------------------+
1 row in set (0.00 sec)

MariaDB [(none)]> SELECT USER(), CURRENT_USER(), @@proxy_user;
+-----------------+----------------+--------------+
| USER()          | CURRENT_USER() | @@proxy_user |
+-----------------+----------------+--------------+
| myuser@localhost | myuser@%        | NULL         |
+-----------------+----------------+--------------+
1 row in set (0.00 sec)

This looks right to my less-than-expert eye.

Now I'm trying to follow the MySQL documentation at http://dev.mysql.com/doc/refman/5.5/en/pam-authentication-plugin.html, under the heading "6.3.6.2.2.3. Unix Password Authentication with Proxy Users and Group Mapping". This may well be my problem: Following MySQL docs for MariaDB - but I haven't been able to find a MariaDB equivalent. Here's what happens.

Per the docs, I create the proxy user, group, etc... Note that 'myuser' is a member of the group 'my-domain-group'.

CREATE USER ''@'' IDENTIFIED WITH pam as 'mysql, my-doman-group=admin';
CREATE USER 'admin'@'localhost' IDENTIFIED BY 'really weird password';
GRANT ALL PRIVILEGES ON *.* TO 'admin'@'localhost';
GRANT PROXY ON 'admin'@'localhost' to ''@'';

Login as 'myuser' works. Let's check our grants:

MariaDB [(none)]> SHOW GRANTS;
+------------------------------------------------------------------------------------------+
| Grants for @                                                                             |
+------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO ''@'' IDENTIFIED VIA pam USING 'mysql, my-doman-group=admin' |
| GRANT PROXY ON 'admin'@'localhost' TO ''@''                                              |
+------------------------------------------------------------------------------------------+
2 rows in set (0.00 sec)

That's what I would expect to see. Now, according to the docs, let's check who we're proxied as:

MariaDB [(none)]> SELECT USER(), CURRENT_USER(), @@proxy_user;
+-----------------+----------------+--------------+
| USER()          | CURRENT_USER() | @@proxy_user |
+-----------------+----------------+--------------+
| myuser@localhost | @              | NULL         |
+-----------------+----------------+--------------+
1 row in set (0.00 sec)

So - there we have it. The 'myuser' account isn't getting access from the 'my-domain-group' as it should, but it is allowed access to login. What gives? Any suggestions?

1 Answer 1

0

As of the time of this answer it states at the top of the referenced mysql doc page:

The PAM authentication plugin is a commercial extension

That means it's available with mySQL Enterprise, which is Oracle's proprietary fork of the mySQL codebase. None of the Enterprise features exist in MariaDB or the community version of mySQL, unless they were rewritten from scratch by somebody outside of Oracle.

It appears that MariaDB has a plugin for this, the docs are at:

https://kb.askmonty.org/en/pam-authentication-plugin

I see no mention of group-mapping, it may not be implemented in the GPLed source code.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .