Move all authenticators into separate subdirectories

server/modules/authenticator/GSSAPI/CMakeLists.txt

@@ -0,0 +1,11 @@
+if (GSSAPI_FOUND AND SQLITE_FOUND)
+  if (NOT SQLITE_VERSION VERSION_LESS "3.7.7")
+    include_directories(${GSSAPI_INCS})
+    include_directories(${SQLITE_INCLUDE_DIR})
+
+    add_subdirectory(GSSAPIAuth)
+    add_subdirectory(GSSAPIBackendAuth)
+  else()
+    message(STATUS "Minimum requires SQLite version for GSSAPIAuth is 3.7.7, current SQLite version is ${SQLITE_VERSION}")
+  endif()
+endif()

server/modules/authenticator/GSSAPI/GSSAPIAuth/CMakeLists.txt

@@ -0,0 +1,4 @@
+add_library(GSSAPIAuth SHARED gssapi_auth.c ../gssapi_auth_common.c)
+target_link_libraries(GSSAPIAuth maxscale-common ${GSSAPI_LIBS} ${SQLITE_LIBRARIES} MySQLCommon)
+set_target_properties(GSSAPIAuth PROPERTIES VERSION "1.0.0")
+install_module(GSSAPIAuth core)

server/modules/authenticator/GSSAPI/GSSAPIAuth/gssapi_auth.c

@@ -0,0 +1,646 @@
+/*
+ * Copyright (c) 2016 MariaDB Corporation Ab
+ *
+ * Use of this software is governed by the Business Source License included
+ * in the LICENSE.TXT file and at www.mariadb.com/bsl.
+ *
+ * Change Date: 2019-07-01
+ *
+ * On the date above, in accordance with the Business Source License, use
+ * of this software will be governed by version 2 or later of the General
+ * Public License.
+ */
+
+#include <maxscale/gw_authenticator.h>
+#include <maxscale/alloc.h>
+#include <maxscale/dcb.h>
+#include <maxscale/log_manager.h>
+#include <maxscale/protocol/mysql.h>
+#include <maxscale/secrets.h>
+#include <maxscale/mysql_utils.h>
+#include <sqlite3.h>
+#include "../gssapi_auth.h"
+
+/** Default timeout is one minute */
+#define MXS_SQLITE_BUSY_TIMEOUT 60000
+
+/**
+ * MySQL queries for retrieving the list of users
+ */
+
+/** Query that gets all users that authenticate via the gssapi plugin */
+const char *gssapi_users_query =
+    "SELECT u.user, u.host, d.db, u.select_priv FROM "
+    "mysql.user AS u LEFT JOIN mysql.db AS d "
+    "ON (u.user = d.user AND u.host = d.host) WHERE u.plugin = 'gssapi' "
+    "UNION "
+    "SELECT u.user, u.host, t.db, u.select_priv FROM "
+    "mysql.user AS u LEFT JOIN mysql.tables_priv AS t "
+    "ON (u.user = t.user AND u.host = t.host) WHERE u.plugin = 'gssapi' "
+    "ORDER BY user";
+
+#define GSSAPI_USERS_QUERY_NUM_FIELDS 4
+
+/**
+ * SQLite queries for authenticating users
+ */
+
+/** Name of the in-memory database */
+#define GSSAPI_DATABASE_NAME "file:gssapi.db?mode=memory&cache=shared"
+
+/** The table name where we store the users */
+#define GSSAPI_TABLE_NAME    "gssapi_users"
+
+/** CREATE TABLE statement for the in-memory table */
+const char create_sql[] =
+    "CREATE TABLE IF NOT EXISTS " GSSAPI_TABLE_NAME
+    "(user varchar(255), host varchar(255), db varchar(255), anydb boolean)";
+
+/** The query that is executed when a user is authenticated */
+static const char gssapi_auth_query[] =
+    "SELECT * FROM " GSSAPI_TABLE_NAME
+    " WHERE user = '%s' AND '%s' LIKE host AND (anydb = '1' OR '%s' = '' OR '%s' LIKE db) LIMIT 1";
+
+/** Delete query used to clean up the database before loading new users */
+static const char delete_query[] = "DELETE FROM " GSSAPI_TABLE_NAME;
+
+/** The insert query template which adds users to the gssapi_users table */
+static const char insert_sql_pattern[] =
+    "INSERT INTO " GSSAPI_TABLE_NAME " VALUES ('%s', '%s', %s, %s)";
+
+/** Used for NULL value creation in the INSERT query */
+static const char null_token[] = "NULL";
+
+/** Flags for sqlite3_open_v2() */
+static int db_flags = SQLITE_OPEN_READWRITE |
+                      SQLITE_OPEN_CREATE |
+                      SQLITE_OPEN_URI |
+                      SQLITE_OPEN_SHAREDCACHE;
+
+/** The instance structure for the client side GSSAPI authenticator, created in
+ *  gssapi_auth_init() */
+typedef struct gssapi_instance
+{
+    char    *principal_name; /**< Service principal name given to the client */
+    sqlite3 *handle;         /**< SQLite3 database handle */
+} GSSAPI_INSTANCE;
+
+/**
+ * @brief Initialize the GSSAPI authenticator
+ *
+ * This function processes the service principal name that is given to the client.
+ *
+ * @param listener Listener port
+ * @param options Listener options
+ * @return Authenticator instance
+ */
+void* gssapi_auth_init(char **options)
+{
+    GSSAPI_INSTANCE *instance = MXS_MALLOC(sizeof(GSSAPI_INSTANCE));
+
+    if (instance)
+    {
+        instance->principal_name = NULL;
+
+        if (sqlite3_open_v2(GSSAPI_DATABASE_NAME, &instance->handle, db_flags, NULL) != SQLITE_OK)
+        {
+            MXS_ERROR("Failed to open SQLite3 handle.");
+            MXS_FREE(instance);
+            return NULL;
+        }
+
+        char *err;
+
+        if (sqlite3_exec(instance->handle, create_sql, NULL, NULL, &err) != SQLITE_OK)
+        {
+            MXS_ERROR("Failed to create database: %s", err);
+            sqlite3_free(err);
+            sqlite3_close_v2(instance->handle);
+            MXS_FREE(instance);
+            return NULL;
+        }
+
+        for (int i = 0; options[i]; i++)
+        {
+            if (strstr(options[i], "principal_name"))
+            {
+                char *ptr = strchr(options[i], '=');
+                if (ptr)
+                {
+                    ptr++;
+                    instance->principal_name = MXS_STRDUP_A(ptr);
+                }
+            }
+            else
+            {
+                MXS_ERROR("Unknown option: %s", options[i]);
+                MXS_FREE(instance->principal_name);
+                MXS_FREE(instance);
+                return NULL;
+            }
+        }
+
+        if (instance->principal_name == NULL)
+        {
+            instance->principal_name = MXS_STRDUP_A(default_princ_name);
+            MXS_NOTICE("Using default principal name: %s", instance->principal_name);
+        }
+    }
+
+    return instance;
+}
+
+void* gssapi_auth_alloc(void *instance)
+{
+    gssapi_auth_t* rval = MXS_MALLOC(sizeof(gssapi_auth_t));
+
+    if (rval)
+    {
+        rval->state = GSSAPI_AUTH_INIT;
+        rval->principal_name = NULL;
+        rval->principal_name_len = 0;
+        rval->sequence = 0;
+
+        if (sqlite3_open_v2(GSSAPI_DATABASE_NAME, &rval->handle, db_flags, NULL) == SQLITE_OK)
+        {
+            sqlite3_busy_timeout(rval->handle, MXS_SQLITE_BUSY_TIMEOUT);
+        }
+        else
+        {
+            MXS_ERROR("Failed to open SQLite3 handle.");
+            MXS_FREE(rval);
+            rval = NULL;
+        }
+    }
+
+    return rval;
+}
+
+void gssapi_auth_free(void *data)
+{
+    if (data)
+    {
+        gssapi_auth_t *auth = (gssapi_auth_t*)data;
+        sqlite3_close_v2(auth->handle);
+        MXS_FREE(auth->principal_name);
+        MXS_FREE(auth);
+    }
+}
+
+/**
+ * @brief Create a AuthSwitchRequest packet
+ *
+ * This function also contains the first part of the GSSAPI authentication.
+ * The server (MaxScale) send the principal name that will be used to generate
+ * the token the client will send us. The principal name needs to exist in the
+ * GSSAPI server in order for the client to be able to request a token.
+ *
+ * @return Allocated packet or NULL if memory allocation failed
+ * @see https://dev.mysql.com/doc/internals/en/connection-phase-packets.html#packet-Protocol::AuthSwitchRequest
+ * @see https://web.mit.edu/kerberos/krb5-1.5/krb5-1.5.4/doc/krb5-user/What-is-a-Kerberos-Principal_003f.html
+ */
+static GWBUF* create_auth_change_packet(GSSAPI_INSTANCE *instance, gssapi_auth_t *auth)
+{
+    size_t principal_name_len = strlen(instance->principal_name);
+    size_t plen = sizeof(auth_plugin_name) + 1 + principal_name_len;
+    GWBUF *buffer = gwbuf_alloc(plen + MYSQL_HEADER_LEN);
+
+    if (buffer)
+    {
+        uint8_t *data = (uint8_t*)GWBUF_DATA(buffer);
+        gw_mysql_set_byte3(data, plen);
+        data += 3;
+        *data++ = ++auth->sequence; // Second packet
+        *data++ = 0xfe; // AuthSwitchRequest command
+        memcpy(data, auth_plugin_name, sizeof(auth_plugin_name)); // Plugin name
+        data += sizeof(auth_plugin_name);
+        memcpy(data, instance->principal_name, principal_name_len); // Plugin data
+    }
+
+    return buffer;
+}
+
+/**
+ * @brief Store the client's GSSAPI token
+ *
+ * This token will be shared with all the DCBs for this session when the backend
+ * GSSAPI authentication is done.
+ *
+ * @param dcb Client DCB
+ * @param buffer Buffer containing the key
+ * @return True on success, false if memory allocation failed
+ */
+bool store_client_token(DCB *dcb, GWBUF *buffer)
+{
+    bool rval = false;
+    uint8_t hdr[MYSQL_HEADER_LEN];
+
+    if (gwbuf_copy_data(buffer, 0, MYSQL_HEADER_LEN, hdr) == MYSQL_HEADER_LEN)
+    {
+        size_t plen = gw_mysql_get_byte3(hdr);
+        MYSQL_session *ses = (MYSQL_session*)dcb->data;
+
+        if ((ses->auth_token = MXS_MALLOC(plen)))
+        {
+            gwbuf_copy_data(buffer, MYSQL_HEADER_LEN, plen, ses->auth_token);
+            ses->auth_token_len = plen;
+            rval = true;
+        }
+    }
+
+    return rval;
+}
+
+/**
+ * @brief Copy username to shared session data
+ * @param dcb Client DCB
+ * @param buffer Buffer containing the first authentication response
+ */
+static void copy_client_information(DCB *dcb, GWBUF *buffer)
+{
+    gssapi_auth_t *auth = (gssapi_auth_t*)dcb->authenticator_data;
+    gwbuf_copy_data(buffer, MYSQL_SEQ_OFFSET, 1, &auth->sequence);
+}
+
+/**
+ * @brief Extract data from client response
+ *
+ * @param dcb Client DCB
+ * @param read_buffer Buffer containing the client's response
+ * @return MXS_AUTH_SUCCEEDED if authentication can continue, MXS_AUTH_FAILED if
+ * authentication failed
+ */
+static int gssapi_auth_extract(DCB *dcb, GWBUF *read_buffer)
+{
+    int rval = MXS_AUTH_FAILED;
+    gssapi_auth_t *auth = (gssapi_auth_t*)dcb->authenticator_data;
+
+    switch (auth->state)
+    {
+        case GSSAPI_AUTH_INIT:
+            copy_client_information(dcb, read_buffer);
+            rval = MXS_AUTH_SUCCEEDED;
+            break;
+
+        case GSSAPI_AUTH_DATA_SENT:
+            store_client_token(dcb, read_buffer);
+            rval = MXS_AUTH_SUCCEEDED;
+            break;
+
+        default:
+            MXS_ERROR("Unexpected authentication state: %d", auth->state);
+            ss_dassert(false);
+            break;
+    }
+
+    return rval;
+}
+
+/**
+ * @brief Is the client SSL capable
+ *
+ * @param dcb Client DCB
+ * @return True if client supports SSL
+ */
+bool gssapi_auth_connectssl(DCB *dcb)
+{
+    MySQLProtocol *protocol = (MySQLProtocol*)dcb->protocol;
+    return protocol->client_capabilities & GW_MYSQL_CAPABILITIES_SSL;
+}
+
+static gss_name_t server_name = GSS_C_NO_NAME;
+
+/**
+ * @brief Check if the client token is valid
+ *
+ * @param token Client token
+ * @param len Length of the token
+ * @return True if client token is valid
+ */
+static bool validate_gssapi_token(uint8_t* token, size_t len)
+{
+    OM_uint32 major = 0, minor = 0;
+    gss_buffer_desc server_buf = {0, 0};
+    gss_cred_id_t credentials;
+
+    /** TODO: Make this configurable */
+    server_buf.value = (void*)default_princ_name;
+    server_buf.length = sizeof(default_princ_name);
+
+    major = gss_import_name(&minor, &server_buf, GSS_C_NT_USER_NAME, &server_name);
+
+    if (GSS_ERROR(major))
+    {
+        report_error(major, minor);
+        return false;
+    }
+
+    major = gss_acquire_cred(&minor, server_name, GSS_C_INDEFINITE,
+                             GSS_C_NO_OID_SET, GSS_C_ACCEPT,
+                             &credentials, NULL, NULL);
+    if (GSS_ERROR(major))
+    {
+        report_error(major, minor);
+        return false;
+    }
+
+    do
+    {
+
+        gss_ctx_id_t handle = NULL;
+        gss_buffer_desc in = {0, 0};
+        gss_buffer_desc out = {0, 0};
+        gss_OID_desc *oid;
+
+
+        in.value = token;
+        in.length = len;
+
+        major = gss_accept_sec_context(&minor, &handle, GSS_C_NO_CREDENTIAL,
+                                       &in, GSS_C_NO_CHANNEL_BINDINGS,
+                                       &server_name, &oid, &out,
+                                       0, 0, NULL);
+        if (GSS_ERROR(major))
+        {
+            return false;
+            report_error(major, minor);
+        }
+    }
+    while (major & GSS_S_CONTINUE_NEEDED);
+
+    return true;
+}
+
+/** @brief Callback for sqlite3_exec() */
+static int auth_cb(void *data, int columns, char** rows, char** row_names)
+{
+    bool *rv = (bool*)data;
+    *rv = true;
+    return 0;
+}
+
+/**
+ * @brief Verify the user has access to the database
+ *
+ * @param auth Authenticator session
+ * @param dcb Client DCB
+ * @param session MySQL session
+ * @return True if the user has access to the database
+ */
+static bool validate_user(gssapi_auth_t *auth, DCB *dcb, MYSQL_session *session)
+{
+    size_t len = sizeof(gssapi_auth_query) + strlen(session->user) +
+                 strlen(session->db) + strlen(dcb->remote);
+    char sql[len + 1];
+    bool rval = false;
+    char *err;
+
+    sprintf(sql, gssapi_auth_query, session->user, dcb->remote, session->db, session->db);
+
+    /**
+     * Try authentication twice; first time with the current users, second
+     * time with fresh users
+     */
+    for (int i = 0; i < 2 && !rval; i++)
+    {
+        if (sqlite3_exec(auth->handle, sql, auth_cb, &rval, &err) != SQLITE_OK)
+        {
+            MXS_ERROR("Failed to execute auth query: %s", err);
+            sqlite3_free(err);
+            rval = false;
+        }
+
+        if (!rval)
+        {
+            service_refresh_users(dcb->service);
+        }
+    }
+
+    return rval;
+}
+
+/**
+ * @brief Authenticate the client
+ *
+ * @param dcb Client DCB
+ * @return MXS_AUTH_INCOMPLETE if authentication is not yet complete, MXS_AUTH_SUCCEEDED
+ * if authentication was successfully completed or MXS_AUTH_FAILED if authentication
+ * has failed.
+ */
+int gssapi_auth_authenticate(DCB *dcb)
+{
+    int rval = MXS_AUTH_FAILED;
+    gssapi_auth_t *auth = (gssapi_auth_t*)dcb->authenticator_data;
+    GSSAPI_INSTANCE *instance = (GSSAPI_INSTANCE*)dcb->listener->auth_instance;
+
+    if (auth->state == GSSAPI_AUTH_INIT)
+    {
+        /** We need to send the authentication switch packet to change the
+         * authentication to something other than the 'mysql_native_password'
+         * method */
+        GWBUF *buffer = create_auth_change_packet(instance, auth);
+
+        if (buffer && dcb->func.write(dcb, buffer))
+        {
+            auth->state = GSSAPI_AUTH_DATA_SENT;
+            rval = MXS_AUTH_INCOMPLETE;
+        }
+    }
+    else if (auth->state == GSSAPI_AUTH_DATA_SENT)
+    {
+        /** We sent the principal name and the client responded with the GSSAPI
+         * token that we must validate */
+
+        MYSQL_session *ses = (MYSQL_session*)dcb->data;
+
+        if (validate_gssapi_token(ses->auth_token, ses->auth_token_len) &&
+            validate_user(auth, dcb, ses))
+        {
+            rval = MXS_AUTH_SUCCEEDED;
+        }
+    }
+
+    return rval;
+}
+
+/**
+ * @brief Free authenticator data from a DCB
+ *
+ * @param dcb DCB to free
+ */
+void gssapi_auth_free_data(DCB *dcb)
+{
+    if (dcb->data)
+    {
+        MYSQL_session *ses = dcb->data;
+        MXS_FREE(ses->auth_token);
+        MXS_FREE(ses);
+        dcb->data = NULL;
+    }
+}
+
+/**
+ * @brief Delete old users from the database
+ * @param handle Database handle
+ */
+static void delete_old_users(sqlite3 *handle)
+{
+    char *err;
+
+    if (sqlite3_exec(handle, delete_query, NULL, NULL, &err) != SQLITE_OK)
+    {
+        MXS_ERROR("Failed to delete old users: %s", err);
+        sqlite3_free(err);
+    }
+}
+
+/**
+ * @brief Add new GSSAPI user to the internal user database
+ *
+ * @param handle Database handle
+ * @param user   Username
+ * @param host   Host
+ * @param db     Database
+ * @param anydb  Global access to databases
+ */
+static void add_gssapi_user(sqlite3 *handle, const char *user, const char *host,
+                            const char *db, bool anydb)
+{
+    size_t dblen = db ? strlen(db) + 2 : sizeof(null_token); /** +2 for single quotes */
+    char dbstr[dblen + 1];
+
+    if (db)
+    {
+        sprintf(dbstr, "'%s'", db);
+    }
+    else
+    {
+        strcpy(dbstr, null_token);
+    }
+
+    size_t len = sizeof(insert_sql_pattern) + strlen(user) + strlen(host) + dblen + 1;
+    char insert_sql[len + 1];
+    sprintf(insert_sql, insert_sql_pattern, user, host, dbstr, anydb ? "1" : "0");
+
+    char *err;
+    if (sqlite3_exec(handle, insert_sql, NULL, NULL, &err) != SQLITE_OK)
+    {
+        MXS_ERROR("Failed to insert user: %s", err);
+        sqlite3_free(err);
+    }
+
+    MXS_INFO("Added user: %s", insert_sql);
+}
+
+/**
+ * @brief Load database users that use GSSAPI authentication
+ *
+ * Loading the list of database users that use the 'gssapi' plugin allows us to
+ * give more precise error messages to the clients when authentication fails.
+ *
+ * @param listener Listener definition
+ * @return MXS_AUTH_LOADUSERS_OK on success, MXS_AUTH_LOADUSERS_ERROR on error
+ */
+int gssapi_auth_load_users(SERV_LISTENER *listener)
+{
+    char *user, *pw;
+    int rval = MXS_AUTH_LOADUSERS_ERROR;
+    GSSAPI_INSTANCE *inst = (GSSAPI_INSTANCE*)listener->auth_instance;
+
+    if (serviceGetUser(listener->service, &user, &pw) && (pw = decryptPassword(pw)))
+    {
+        for (SERVER_REF *servers = listener->service->dbref; servers; servers = servers->next)
+        {
+            MYSQL *mysql = mysql_init(NULL);
+
+            if (mxs_mysql_real_connect(mysql, servers->server, user, pw))
+            {
+                if (mysql_query(mysql, gssapi_users_query))
+                {
+                    MXS_ERROR("Failed to query server '%s' for GSSAPI users: %s",
+                              servers->server->unique_name, mysql_error(mysql));
+                }
+                else
+                {
+                    MYSQL_RES *res = mysql_store_result(mysql);
+
+                    delete_old_users(inst->handle);
+
+                    if (res)
+                    {
+                        ss_dassert(mysql_num_fields(res) == GSSAPI_USERS_QUERY_NUM_FIELDS);
+                        MYSQL_ROW row;
+
+                        while ((row = mysql_fetch_row(res)))
+                        {
+                            add_gssapi_user(inst->handle, row[0], row[1], row[2],
+                                            row[3] && strcasecmp(row[3], "Y") == 0);
+                        }
+
+                        rval = MXS_AUTH_LOADUSERS_OK;
+                        mysql_free_result(res);
+                    }
+                }
+
+                mysql_close(mysql);
+
+                if (rval == MXS_AUTH_LOADUSERS_OK)
+                {
+                    break;
+                }
+            }
+        }
+
+        MXS_FREE(pw);
+    }
+
+    return rval;
+}
+
+/**
+ * Implementation of the authenticator module interface
+ */
+static GWAUTHENTICATOR MyObject =
+{
+    gssapi_auth_init,                /* Initialize authenticator */
+    gssapi_auth_alloc,               /* Allocate authenticator data */
+    gssapi_auth_extract,             /* Extract data into structure   */
+    gssapi_auth_connectssl,          /* Check if client supports SSL  */
+    gssapi_auth_authenticate,        /* Authenticate user credentials */
+    gssapi_auth_free_data,           /* Free the client data held in DCB */
+    gssapi_auth_free,                /* Free authenticator data */
+    gssapi_auth_load_users           /* Load database users */
+};
+
+MODULE_INFO info =
+{
+    MODULE_API_AUTHENTICATOR,
+    MODULE_GA,
+    GWAUTHENTICATOR_VERSION,
+    "GSSAPI authenticator"
+};
+
+static char version_str[] = "V1.0.0";
+
+/**
+ * Version string entry point
+ */
+char* version()
+{
+    return version_str;
+}
+
+/**
+ * Module initialization entry point
+ */
+void ModuleInit()
+{
+}
+
+/**
+ * Module handle entry point
+ */
+GWAUTHENTICATOR* GetModuleObject()
+{
+    return &MyObject;
+}

server/modules/authenticator/GSSAPI/GSSAPIBackendAuth/CMakeLists.txt

@@ -0,0 +1,4 @@
+add_library(GSSAPIBackendAuth SHARED gssapi_backend_auth.c ../gssapi_auth_common.c)
+target_link_libraries(GSSAPIBackendAuth maxscale-common  ${GSSAPI_LIBS} MySQLCommon)
+set_target_properties(GSSAPIBackendAuth PROPERTIES VERSION "1.0.0")
+install_module(GSSAPIBackendAuth core)

server/modules/authenticator/GSSAPI/GSSAPIBackendAuth/gssapi_backend_auth.c

@@ -0,0 +1,309 @@
+/*
+ * Copyright (c) 2016 MariaDB Corporation Ab
+ *
+ * Use of this software is governed by the Business Source License included
+ * in the LICENSE.TXT file and at www.mariadb.com/bsl.
+ *
+ * Change Date: 2019-07-01
+ *
+ * On the date above, in accordance with the Business Source License, use
+ * of this software will be governed by version 2 or later of the General
+ * Public License.
+ */
+
+#include <maxscale/gw_authenticator.h>
+#include <maxscale/alloc.h>
+#include <maxscale/dcb.h>
+#include <maxscale/log_manager.h>
+#include <maxscale/protocol/mysql.h>
+#include "../gssapi_auth.h"
+
+/**
+ * @file gssapi_backend_auth.c - GSSAPI backend authenticator
+ */
+
+void* gssapi_backend_auth_alloc(void *instance)
+{
+    gssapi_auth_t* rval = MXS_MALLOC(sizeof(gssapi_auth_t));
+
+    if (rval)
+    {
+        rval->state = GSSAPI_AUTH_INIT;
+        rval->principal_name = NULL;
+        rval->principal_name_len = 0;
+        rval->sequence = 0;
+    }
+
+    return rval;
+}
+
+void gssapi_backend_auth_free(void *data)
+{
+    if (data)
+    {
+        gssapi_auth_t *auth = (gssapi_auth_t*)data;
+        MXS_FREE(auth->principal_name);
+        MXS_FREE(auth);
+    }
+}
+
+/**
+ * @brief Create a new GSSAPI token
+ * @param dcb Backend DCB
+ * @return True on success, false on error
+ */
+static bool send_new_auth_token(DCB *dcb)
+{
+    bool rval = false;
+    OM_uint32 major = 0, minor = 0;
+    gss_ctx_id_t handle = NULL;
+    gss_buffer_desc in = {0, 0};
+    gss_buffer_desc out = {0, 0};
+    gss_buffer_desc target = {0, 0};
+    gss_name_t princ = GSS_C_NO_NAME;
+    gssapi_auth_t *auth = (gssapi_auth_t*)dcb->authenticator_data;
+
+    /** The service principal name is sent by the backend server */
+    target.value = auth->principal_name;
+    target.length = auth->principal_name_len + 1;
+
+    /** Convert the name into GSSAPI format */
+    major = gss_import_name(&minor, &target, GSS_C_NT_USER_NAME, &princ);
+
+    if (GSS_ERROR(major))
+    {
+        report_error(major, minor);
+    }
+
+    /** Request the token for the service */
+    major = gss_init_sec_context(&minor, GSS_C_NO_CREDENTIAL,
+                                 &handle, princ, GSS_C_NO_OID, 0, 0,
+                                 GSS_C_NO_CHANNEL_BINDINGS, &in, NULL, &out, 0, 0);
+    if (GSS_ERROR(major))
+    {
+        report_error(major, minor);
+    }
+    else
+    {
+        /** We successfully requested the token, send it to the backend server */
+        GWBUF *buffer = gwbuf_alloc(MYSQL_HEADER_LEN + out.length);
+
+        if (buffer)
+        {
+            uint8_t *data = (uint8_t*)GWBUF_DATA(buffer);
+            gw_mysql_set_byte3(data, out.length);
+            data += 3;
+            *data++ = ++auth->sequence;
+            memcpy(data, out.value, out.length);
+
+            if (dcb_write(dcb, buffer))
+            {
+                rval = true;
+            }
+        }
+
+        major = gss_delete_sec_context(&minor, &handle, &in);
+
+        if (GSS_ERROR(major))
+        {
+            report_error(major, minor);
+        }
+
+        major = gss_release_name(&minor, &princ);
+
+        if (GSS_ERROR(major))
+        {
+            report_error(major, minor);
+        }
+    }
+
+    return rval;
+
+}
+
+/**
+ * @brief Extract the principal name from the AuthSwitchRequest packet
+ *
+ * @param dcb Backend DCB
+ * @param buffer Buffer containing an AuthSwitchRequest packet
+ * @return True on success, false on error
+ */
+bool extract_principal_name(DCB *dcb, GWBUF *buffer)
+{
+    bool rval = false;
+    size_t buflen = gwbuf_length(buffer) - MYSQL_HEADER_LEN;
+    uint8_t databuf[buflen];
+    uint8_t *data = databuf;
+    gssapi_auth_t *auth = (gssapi_auth_t*)dcb->authenticator_data;
+
+    /** Copy the payload and the current packet sequence number */
+    gwbuf_copy_data(buffer, MYSQL_HEADER_LEN, buflen, databuf);
+    gwbuf_copy_data(buffer, MYSQL_SEQ_OFFSET, 1, &auth->sequence);
+
+    if (databuf[0] != MYSQL_REPLY_AUTHSWITCHREQUEST)
+    {
+        /** Server responded with something we did not expect. If it's an OK packet,
+         * it's possible that the server authenticated us as the anonymous user. This
+         * means that the server is not secure. */
+        MXS_ERROR("Server '%s' returned an unexpected authentication response.%s",
+                  dcb->server->unique_name, databuf[0] == MYSQL_REPLY_OK ?
+                  " Authentication was complete before it even started, "
+                  "anonymous users might not be disabled." : "");
+        return false;
+    }
+
+    /**
+     * The AuthSwitchRequest packet
+     *
+     * 0xfe        - Command byte
+     * string[NUL] - Auth plugin name
+     * string[EOF] - Auth plugin data
+     *
+     * Skip over the auth plugin name and copy the service principal name stored
+     * in the auth plugin data section.
+     */
+    while (*data && data < databuf + buflen)
+    {
+        data++;
+    }
+
+    data++;
+    buflen -= data - databuf;
+
+    if (buflen > 0)
+    {
+        uint8_t *principal = MXS_MALLOC(buflen + 1);
+
+        if (principal)
+        {
+            /** Store the principal name for later when we request the token
+             * from the GSSAPI server */
+            memcpy(principal, data, buflen);
+            principal[buflen] = '\0';
+            auth->principal_name = principal;
+            auth->principal_name_len = buflen;
+            rval = true;
+        }
+    }
+    else
+    {
+        MXS_ERROR("Backend server did not send any auth plugin data.");
+    }
+
+    return rval;
+}
+
+/**
+ * @brief Extract data from a MySQL packet
+ * @param dcb Backend DCB
+ * @param buffer Buffer containing a complete packet
+ * @return MXS_AUTH_INCOMPLETE if authentication is ongoing, MXS_AUTH_SUCCEEDED
+ * if authentication is complete and MXS_AUTH_FAILED if authentication failed.
+ */
+static int gssapi_backend_auth_extract(DCB *dcb, GWBUF *buffer)
+{
+    int rval = MXS_AUTH_FAILED;
+    gssapi_auth_t *auth = (gssapi_auth_t*)dcb->authenticator_data;
+
+    if (auth->state == GSSAPI_AUTH_INIT && extract_principal_name(dcb, buffer))
+    {
+        rval = MXS_AUTH_INCOMPLETE;
+    }
+    else if (auth->state == GSSAPI_AUTH_DATA_SENT)
+    {
+        /** Read authentication response */
+        if (mxs_mysql_is_ok_packet(buffer))
+        {
+            auth->state = GSSAPI_AUTH_OK;
+            rval = MXS_AUTH_SUCCEEDED;
+        }
+    }
+
+    return rval;
+}
+
+/**
+ * @brief Check whether the DCB supports SSL
+ * @param dcb Backend DCB
+ * @return True if DCB supports SSL
+ */
+static bool gssapi_backend_auth_connectssl(DCB *dcb)
+{
+    return dcb->server->server_ssl != NULL;
+}
+
+/**
+ * @brief Authenticate the backend connection
+ * @param dcb Backend DCB
+ * @return MXS_AUTH_INCOMPLETE if authentication is ongoing, MXS_AUTH_SUCCEEDED
+ * if authentication is complete and MXS_AUTH_FAILED if authentication failed.
+ */
+static int gssapi_backend_auth_authenticate(DCB *dcb)
+{
+    int rval = MXS_AUTH_FAILED;
+    gssapi_auth_t *auth = (gssapi_auth_t*)dcb->authenticator_data;
+
+    if (auth->state == GSSAPI_AUTH_INIT)
+    {
+        if (send_new_auth_token(dcb))
+        {
+            rval = MXS_AUTH_INCOMPLETE;
+            auth->state = GSSAPI_AUTH_DATA_SENT;
+        }
+
+    }
+    else if (auth->state == GSSAPI_AUTH_OK)
+    {
+        rval = MXS_AUTH_SUCCEEDED;
+    }
+
+    return rval;
+}
+
+/**
+ * Implementation of the authenticator module interface
+ */
+static GWAUTHENTICATOR MyObject =
+{
+    NULL,                               /* No initialize entry point */
+    gssapi_backend_auth_alloc,                  /* Allocate authenticator data */
+    gssapi_backend_auth_extract,        /* Extract data into structure   */
+    gssapi_backend_auth_connectssl,     /* Check if client supports SSL  */
+    gssapi_backend_auth_authenticate,   /* Authenticate user credentials */
+    NULL,                               /* Client plugin will free shared data */
+    gssapi_backend_auth_free,                   /* Free authenticator data */
+    NULL                                /* Load users from backend databases */
+};
+
+MODULE_INFO info =
+{
+    MODULE_API_AUTHENTICATOR,
+    MODULE_GA,
+    GWAUTHENTICATOR_VERSION,
+    "GSSAPI backend authenticator"
+};
+
+static char *version_str = "V1.0.0";
+
+/**
+ * Version string entry point
+ */
+char* version()
+{
+    return version_str;
+}
+
+/**
+ * Module initialization entry point
+ */
+void ModuleInit()
+{
+}
+
+/**
+ * Module handle entry point
+ */
+GWAUTHENTICATOR* GetModuleObject()
+{
+    return &MyObject;
+}

server/modules/authenticator/GSSAPI/gssapi_auth.h

@@ -0,0 +1,55 @@
+#pragma once
+#ifndef _GSSAPI_AUTH_H
+#define _GSSAPI_AUTH_H
+/*
+ * Copyright (c) 2016 MariaDB Corporation Ab
+ *
+ * Use of this software is governed by the Business Source License included
+ * in the LICENSE.TXT file and at www.mariadb.com/bsl.
+ *
+ * Change Date: 2019-07-01
+ *
+ * On the date above, in accordance with the Business Source License, use
+ * of this software will be governed by version 2 or later of the General
+ * Public License.
+ */
+
+#include <maxscale/cdefs.h>
+#include <stdint.h>
+#include <stddef.h>
+#include <gssapi.h>
+#include <sqlite3.h>
+
+MXS_BEGIN_DECLS
+
+/** Client auth plugin name */
+static const char auth_plugin_name[] = "auth_gssapi_client";
+
+/** This is mainly for testing purposes */
+static const char default_princ_name[] = "mariadb/localhost.localdomain";
+
+/** GSSAPI authentication states */
+enum gssapi_auth_state
+{
+    GSSAPI_AUTH_INIT = 0,
+    GSSAPI_AUTH_DATA_SENT,
+    GSSAPI_AUTH_OK,
+    GSSAPI_AUTH_FAILED
+};
+
+/** Common structure for both backend and client authenticators */
+typedef struct gssapi_auth
+{
+    enum gssapi_auth_state state; /**< Authentication state*/
+    uint8_t *principal_name;      /**< Principal name */
+    size_t principal_name_len;    /**< Length of the principal name */
+    uint8_t sequence;             /**< The next packet seqence number */
+    sqlite3 *handle;              /**< SQLite3 database handle */
+} gssapi_auth_t;
+
+/** Report GSSAPI errors */
+void report_error(OM_uint32 major, OM_uint32 minor);
+
+MXS_END_DECLS
+
+#endif

server/modules/authenticator/GSSAPI/gssapi_auth_common.c

@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2016 MariaDB Corporation Ab
+ *
+ * Use of this software is governed by the Business Source License included
+ * in the LICENSE.TXT file and at www.mariadb.com/bsl.
+ *
+ * Change Date: 2019-07-01
+ *
+ * On the date above, in accordance with the Business Source License, use
+ * of this software will be governed by version 2 or later of the General
+ * Public License.
+ */
+
+#include "gssapi_auth.h"
+#include <maxscale/alloc.h>
+#include <maxscale/log_manager.h>
+
+/**
+ * @brief Report GSSAPI errors
+ *
+ * @param major GSSAPI major error number
+ * @param minor GSSAPI minor error number
+ */
+void report_error(OM_uint32 major, OM_uint32 minor)
+{
+    OM_uint32 status_maj = major;
+    OM_uint32 status_min = minor;
+    OM_uint32 res = 0;
+    gss_buffer_desc buf = {0, 0};
+
+    major = gss_display_status(&minor, status_maj, GSS_C_GSS_CODE, NULL, &res, &buf);
+
+    {
+        char sbuf[buf.length + 1];
+        memcpy(sbuf, buf.value, buf.length);
+        sbuf[buf.length] = '\0';
+        MXS_ERROR("GSSAPI Major Error: %s", sbuf);
+    }
+
+    major = gss_display_status(&minor, status_min, GSS_C_MECH_CODE, NULL, &res, &buf);
+
+    {
+        char sbuf[buf.length + 1];
+        memcpy(sbuf, buf.value, buf.length);
+        sbuf[buf.length] = '\0';
+        MXS_ERROR("GSSAPI Minor Error: %s", sbuf);
+    }
+}