Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

auth, variables: add description about ldap authentication #13501

Merged
merged 9 commits into from
May 24, 2023
Merged

auth, variables: add description about ldap authentication #13501

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
6929eba
add description about ldap authentication
YangKeao May 9, 2023
21ff610
remove ldap authentication table
YangKeao May 11, 2023
5782bd5
add version mark
YangKeao May 11, 2023
61ca41b
Apply suggestions from code review
CbcWestwolf May 12, 2023
7e584e7
Apply suggestions from code review
CbcWestwolf May 22, 2023
5114002
Update system-variables.md
ran-huang May 23, 2023
0ce1b51
adjust the variables order
ran-huang May 24, 2023
3d44ee7
size -> connections
ran-huang May 24, 2023
ef245c0
Update system-variables.md
ran-huang May 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 16 additions & 14 deletions security-compatibility-with-mysql.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,17 +124,19 @@ The support for TLS authentication is configured differently. For detailed infor

</CustomContent>

| Authentication Method | Supported |
| :------------------------| :--------------- |
| `mysql_native_password` | Yes |
| `sha256_password` | No |
| `caching_sha2_password` | Yes, since 5.2.0 |
| `auth_socket` | Yes, since 5.3.0 |
| `tidb_sm3_password` | Yes, since 6.3.0 |
| `tidb_auth_token` | Yes, since 6.4.0 |
| TLS Certificates | Yes |
| LDAP | No |
| PAM | No |
| ed25519 (MariaDB) | No |
| GSSAPI (MariaDB) | No |
| FIDO | No |
| Authentication Method | Supported |
| :----------------------------| :--------------- |
| `mysql_native_password` | Yes |
| `sha256_password` | No |
| `caching_sha2_password` | Yes, since 5.2.0 |
| `auth_socket` | Yes, since 5.3.0 |
| `tidb_sm3_password` | Yes, since 6.3.0 |
| `tidb_auth_token` | Yes, since 6.4.0 |
| `authentication_ldap_sasl` | Yes, since 7.1.0 |
| `authentication_ldap_simple` | Yes, since 7.1.0 |
| TLS Certificates | Yes |
| LDAP | Yes, since 7.1.0 |
| PAM | No |
| ed25519 (MariaDB) | No |
| GSSAPI (MariaDB) | No |
| FIDO | No |
170 changes: 169 additions & 1 deletion system-variables.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,174 @@ SET GLOBAL tidb_distsql_scan_concurrency = 10;
- Default value: `OFF`
- Determines whether to allow explicitly specifying the values of the column with the `AUTO_RANDOM` attribute in the `INSERT` statement.

### authentication_ldap_sasl_auth_method_name <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: Enumeration
- Default value: `SCRAM-SHA-1`
- Possible values: `SCRAM-SHA-1`, `SCRAM-SHA-256`, and `GSSAPI`.
- For LDAP SASL authentication, this variable specifies the authentication method name.

### authentication_ldap_sasl_bind_base_dn <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: String
- Default value: ""
- For LDAP SASL authentication, this variable limits the search scope within the search tree. If a user is created without the `AS ...` clause, TiDB will automatically search the `dn` in LDAP server according to the user name.

### authentication_ldap_sasl_bind_root_dn <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: String
- Default value: ""
- For LDAP SASL authentication, this variable specifies the `dn` used to log in to the LDAP server to search users.

### authentication_ldap_sasl_bind_root_pwd <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: String
- Default value: ""
- For LDAP SASL authentication, this variable specifies the password used to log in to the LDAP server to search users.

### authentication_ldap_sasl_ca_path <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: String
- Default value: ""
- For LDAP SASL authentication, this variable specifies the absolute path of the certificate authority file for StartTLS connections.

### authentication_ldap_sasl_init_pool_size <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: Integer
- Default value: `10`
- Range: `[1, 32767]`
- For LDAP SASL authentication, this variable specifies the initial connections in the connection pool to the LDAP server.

### authentication_ldap_sasl_max_pool_size <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: Integer
- Default value: `1000`
- Range: `[1, 32767]`
- For LDAP SASL authentication, this variable specifies the maximum connections in the connection pool to the LDAP server.

### authentication_ldap_sasl_server_host <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: String
- Default value: ""
- For LDAP SASL authentication, this variable specifies the LDAP server host name or IP address.

### authentication_ldap_sasl_server_port <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: Integer
- Default value: `389`
- Range: `[1, 65535]`
- For LDAP SASL authentication, this variable specifies the TCP/IP port number of the LDAP server.

### authentication_ldap_sasl_tls <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: Boolean
- Default value: `OFF`
- For LDAP SASL authentication, this variable controls whether connections by the plugin to the LDAP server are protected with StartTLS.

### authentication_ldap_simple_auth_method_name <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: Enumeration
- Default value: `SIMPLE`
- Possible values: `SIMPLE`.
- For LDAP simple authentication, this variable specifies the authentication method name. The only supported value is `SIMPLE`.

### authentication_ldap_simple_bind_base_dn <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: String
- Default value: ""
- For LDAP simple authentication, this variable limits the search scope within the search tree. If a user is created without the `AS ...` clause, TiDB will automatically search the `dn` in LDAP server according to the user name.

### authentication_ldap_simple_bind_root_dn <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: String
- Default value: ""
- For LDAP simple authentication, this variable specifies the `dn` used to log in to the LDAP server to search users.

### authentication_ldap_simple_bind_root_pwd <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: String
- Default value: ""
- For LDAP simple authentication, this variable specifies the password used to log in to the LDAP server to search users.

### authentication_ldap_simple_ca_path <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: String
- Default value: ""
- For LDAP simple authentication, this variable specifies the absolute path of the certificate authority file for StartTLS connections.

### authentication_ldap_simple_init_pool_size <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: Integer
- Default value: `10`
- Range: `[1, 32767]`
- For LDAP simple authentication, this variable specifies the initial connections in the connection pool to the LDAP server.

### authentication_ldap_simple_max_pool_size <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: Integer
- Default value: `1000`
- Range: `[1, 32767]`
- For LDAP simple authentication, this variable specifies the maximum connections in the connection pool to the LDAP server.

### authentication_ldap_simple_server_host <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: String
- Default value: ""
- For LDAP simple authentication, this variable specifies the LDAP server host name or IP address.

### authentication_ldap_simple_server_port <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: Integer
- Default value: `389`
- Range: `[1, 65535]`
- For LDAP simple authentication, this variable specifies the TCP/IP port number of the LDAP server.

### authentication_ldap_simple_tls <span class="version-mark">New in v7.1.0</span>

- Scope: GLOBAL
- Persists to cluster: Yes
- Type: Boolean
- Default value: `OFF`
- For LDAP simple authentication, this variable controls whether connections by the plugin to the LDAP server are protected with StartTLS.

### auto_increment_increment

- Scope: SESSION | GLOBAL
Expand Down Expand Up @@ -225,7 +393,7 @@ mysql> SELECT * FROM t1;
- Persists to cluster: Yes
- Type: Enumeration
- Default value: `mysql_native_password`
- Possible values: `mysql_native_password`, `caching_sha2_password`, `tidb_sm3_password`, and `tidb_auth_token`
- Possible values: `mysql_native_password`, `caching_sha2_password`, `tidb_sm3_password`, `tidb_auth_token`, `authentication_ldap_sasl`, and `authentication_ldap_simple`.
- The `tidb_auth_token` authentication method is used only for the internal operation of TiDB Cloud. **DO NOT** set the variable to this value.
- This variable sets the authentication method that the server advertises when the server-client connection is being established.
- To authenticate using the `tidb_sm3_password` method, you can connect to TiDB using [TiDB-JDBC](https://github.com/pingcap/mysql-connector-j/tree/release/8.0-sm3).
Expand Down