Description:
authentication_openid_connect_client takes the ID token file with
mysql_plugin_options(plugin, "id-token-file", path). That is one value for the whole
process, while the token is a credential of one connection.
A program that uses libmysqlclient directly can have several threads and several
connections, each with its own server, account and token file. With one plugin-wide
value it must set the path and connect under its own lock, and it cannot let the
library log in again by itself (mysql_change_user(), MYSQL_OPT_RECONNECT), because it
cannot set the path before that login.
The post-push fix 2f7adb7ffb70 of WL#16269 now frees the path after each login, with
the reason "ID token is like a password". Does that change make sense?
- The path is not the credential; the token in the file is. The plugin reads the
token at each login and does not keep it, before and after this change.
- The mysql client keeps the same path in its own option for the whole process
anyway.
- What the change does do is make every later login on the process fail with
"The path to ID token file is not set.": a second connection, mysql_change_user()
and auto-reconnect.
If the concern was that a later connection silently uses an earlier connection's
token file, the cause is that the option is plugin-wide, not that the path is kept.
We think the token file should be a setting of the connection, like the password.
How to repeat:
# 1. Packages
sudo apt-get update
sudo apt-get install -y wget ca-certificates xz-utils gcc libc6-dev openssl perl libncurses6
# 2. Downloads (79 MB + 173 MB)
cd /home/satya/Downloads/oidc_upstream_bug
wget https://dev.mysql.com/get/Downloads/MySQL-9.7/mysql-9.7.2-linux-glibc2.28-x86_64-minimal.t...
tar xJf mysql-9.7.2-linux-glibc2.28-x86_64-minimal.tar.xz
wget https://downloads.percona.com/downloads/Percona-Server-9.7/Percona-Server-9.7.2-2/binary/t...
tar xzf Percona-Server-9.7.2-2-Linux.x86_64.glibc2.35-minimal.tar.gz
# 3. Run
chmod +x repro.sh
./repro.sh Percona-Server-9.7.2-2-Linux.x86_64.glibc2.35-minimal \
mysql-9.7.2-linux-glibc2.28-x86_64-minimal
----
Server: any server with an OIDC server plugin and an account IDENTIFIED WITH it
(we used Percona Server 9.7.2-2, whose auth_openid_connect plugin is open source).
Attached probe.c sets the option once, then:
./repro.sh Percona-Server-9.7.2-2-Linux.x86_64.glibc2.35-minimal \
mysql-9.7.2-linux-glibc2.28-x86_64-minimal
== work dir /tmp/oidc_repro.ZHzWHz
== probe output (plugin messages go to stderr)
1a first connect (option set) OK
The path to ID token file is not set.
1b second connect (option not set again) FAILED: Unknown MySQL error
The path to ID token file is not set.
2a mysql_change_user (option not set again) FAILED: Unknown MySQL error
2b mysql_change_user (option set again, control) OK
WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version.
3a connect with MYSQL_OPT_RECONNECT OK
The path to ID token file is not set.
3b query after KILL, auto-reconnect (option not set) FAILED: Unknown MySQL error
WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version.
3c same, option set again before reconnect (control) OK
---
Every failure prints "The path to ID token file is not set." from the plugin, while
mysql_error() says only "Unknown MySQL error".
Attached repro.sh runs it end to end on a Unix socket: it starts the server, creates a
local identity provider key and the OIDC account, signs a token, builds and runs
probe.c, and stops the server. It needs gcc, openssl and perl
