Brian Aker wrote: > Hi! > > I worked out an example PAM authentication plugin this weekend. This is > about what I learned: > > Server: > > There is quite a bit more that needs to be done on the server right now: > 1) Final cleanup of old security context. > 2) THD needs to be split out sooner then later. > 3) We need to private'ize more of THD. > 4) We use a VOID pointer to pass in a structure to plugins for > init/finalize. I keep finding myself wondering if that should be a base > class that we inherit from (aka I am starting to see certain patterns > reoccurring in plugins).
++ > 5) We need to do something about the MYSQL_SERVER define (though this > may solve itself once we cut down on more of the linking). I want this to go away. Totally. > 6) my_rnd() is still sitting in passwd.c, it belongs in mysys. > 7) We need a call like ap_get_module_config() for session and query. > > Clients: > > The current SALT + encrypt +encrypt system is pretty unique, aka none of > these keys will map to anything. Now we could just md5 the password and > send it across the socket. This will give us some common sign-ons but it > will no solve everything. > > I believe to get around this we need to add an encryption callback that > will allow someone to pass a function to the client driver which will > all the password to be massaged on the client side to match the server. > This should allow for the flexibility to do pretty much anything as far > as matching remote systems goes. > > The protocol is really subpar for how users use MySQL, let alone > Drizzle. The round trip on connect needs to go away for those who need > to optimize on packet trips. > > I believe we should consider shipping, by default, an AUTH which limits > connections to localhost. I suspect the Debian folks are going to want > this. Yes. They will definitely want this. > Codestye: > Look at how I set up authentication.cc, I'd like to see us pull the > plugin code into their own files (handlerton, I_S, UDF...). I don't know > if we should call these factories, but these systems are the future of > how we will communicate with pieces on the edge. A common style would be > a good idea :) > > Cheers, > -Brian > > BTW for those who have not followed earlier emails, our plugin system is > tightly coupled, not loosely coupled like the MySQL one. We expect that > you have to compile for the version your plugin is used against. > > -- > _______________________________________________________ > Brian "Krow" Aker, brian at tangent.org > Seattle, Washington > http://krow.net/ <-- Me > http://tangent.org/ <-- Software > _______________________________________________________ > You can't grep a dead tree. > > > > > _______________________________________________ > Mailing list: https://launchpad.net/~drizzle-discuss > Post to : [email protected] > Unsubscribe : https://launchpad.net/~drizzle-discuss > More help : https://help.launchpad.net/ListHelp > _______________________________________________ Mailing list: https://launchpad.net/~drizzle-discuss Post to : [email protected] Unsubscribe : https://launchpad.net/~drizzle-discuss More help : https://help.launchpad.net/ListHelp
