forked from fl00r/go-tarantool-1.6
-
Notifications
You must be signed in to change notification settings - Fork 60
Closed
Description
We need to support a new authorization mechanizm PAP-SHA256, RFC:
https://www.notion.so/tarantool/Authentication-methods-908501aa74834bdea70c384d6df97105
We need:
- To add Opts.AuthType to force 'chap-sha1' or 'pap-sha256' authorization method here:
Line 215 in d6d0031
type Opts struct { - To check
IPROTO_AUTH_TYPE = 0x5b
here:
Lines 195 to 210 in d6d0031
case KeyVersion: if err = d.Decode(&serverProtocolInfo.Version); err != nil { return err } case KeyFeatures: if larr, err = d.DecodeArrayLen(); err != nil { return err } serverProtocolInfo.Features = make([]ProtocolFeature, larr) for i := 0; i < larr; i++ { if err = d.Decode(&feature); err != nil { return err } serverProtocolInfo.Features[i] = feature }
and add the information about auth type to IdRequest response. - To choose an authorization method by priority: Opts.AuthType -> IPROTO_AUTH_TYPE -> 'chap-sha1' (default).
- To implement the method
pap-sha256
for authReques according to the RFC:
https://github.com/tarantool/go-tarantool/blob/d6d0031d7a0ce9959edf57f9407bba9652a37506/auth.go
Lines 598 to 603 in d6d0031
func (req *authRequest) Body(res SchemaResolver, enc *encoder) error { return enc.Encode(map[uint32]interface{}{ KeyUserName: req.user, KeyTuple: []interface{}{string("chap-sha1"), string(req.scramble)}, }) }
The connector should refuse to use PAP-SHA256 unless the network channel is encrypted with SSL/TLS.
Linked issues:
tarantool/tarantool#7987
tarantool/tarantool#7988
tarantool/tarantool#7989
https://github.com/tarantool/tarantool-ee/issues/295
https://github.com/tarantool/enterprise_doc/issues/206
Metadata
Metadata
Assignees
Labels
No labels