MXS-862: Implement GSSAPI backend authentication

The GSSAPI backend authentication is based on tokens.  The server first
sends the service principal name which is used for token generation. The
client then retrieves a token from the GSSAPI server which it sends to the
backend server. If the server can verify the authenticity of the token,
authentication is successful.

This module can be used with both GSSAPIAuth and MySQLAuth modules.
This commit is contained in:
Markus Makela
2016-10-05 22:59:25 +03:00
parent 5d96faedd8
commit a2a8562c39
5 changed files with 191 additions and 48 deletions

View File

@ -14,6 +14,9 @@
#ifndef _GSSAPI_AUTH_H
#define _GSSAPI_AUTH_H
#include <stdint.h>
#include <stddef.h>
#include <gssapi.h>
/** Client auth plugin name */
static const char auth_plugin_name[] = "auth_gssapi_client";
@ -34,10 +37,15 @@ enum gssapi_auth_state
typedef struct gssapi_auth
{
enum gssapi_auth_state state;
uint8_t *principal_name;
size_t principal_name_len;
} gssapi_auth_t;
/** These functions can used for the `create` and `destroy` entry points */
void* gssapi_auth_alloc();
void gssapi_auth_free(void *data);
/** Report GSSAPI errors */
void report_error(OM_uint32 major, OM_uint32 minor);
#endif