Hi!
I worked out an example PAM authentication plugin this weekend. This
is about what I learned:
Server:
There is quite a bit more that needs to be done on the server right now:
1) Final cleanup of old security context.
2) THD needs to be split out sooner then later.
3) We need to private'ize more of THD.
4) We use a VOID pointer to pass in a structure to plugins for init/
finalize. I keep finding myself wondering if that should be a base
class that we inherit from (aka I am starting to see certain patterns
reoccurring in plugins).
5) We need to do something about the MYSQL_SERVER define (though this
may solve itself once we cut down on more of the linking).
6) my_rnd() is still sitting in passwd.c, it belongs in mysys.
7) We need a call like ap_get_module_config() for session and query.
Clients:
The current SALT + encrypt +encrypt system is pretty unique, aka none
of these keys will map to anything. Now we could just md5 the password
and send it across the socket. This will give us some common sign-ons
but it will no solve everything.
I believe to get around this we need to add an encryption callback
that will allow someone to pass a function to the client driver which
will all the password to be massaged on the client side to match the
server. This should allow for the flexibility to do pretty much
anything as far as matching remote systems goes.
The protocol is really subpar for how users use MySQL, let alone
Drizzle. The round trip on connect needs to go away for those who need
to optimize on packet trips.
I believe we should consider shipping, by default, an AUTH which
limits connections to localhost. I suspect the Debian folks are going
to want this.
Codestye:
Look at how I set up authentication.cc, I'd like to see us pull the
plugin code into their own files (handlerton, I_S, UDF...). I don't
know if we should call these factories, but these systems are the
future of how we will communicate with pieces on the edge. A common
style would be a good idea :)
Cheers,
-Brian
BTW for those who have not followed earlier emails, our plugin system
is tightly coupled, not loosely coupled like the MySQL one. We expect
that you have to compile for the version your plugin is used against.
--
_______________________________________________________
Brian "Krow" Aker, brian at tangent.org
Seattle, Washington
http://krow.net/ <-- Me
http://tangent.org/ <-- Software
_______________________________________________________
You can't grep a dead tree.
_______________________________________________
Mailing list: https://launchpad.net/~drizzle-discuss
Post to : [email protected]
Unsubscribe : https://launchpad.net/~drizzle-discuss
More help : https://help.launchpad.net/ListHelp
