Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Security Compatibility with MySQL #5921

Merged
merged 2 commits into from
Jul 29, 2021
Merged

Update Security Compatibility with MySQL #5921

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cbc474f
Update Security Compatibility with MySQL
dveeden Jul 5, 2021
7ac50a3
Apply suggestions from code review
TomShawn Jul 29, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 22 additions & 2 deletions security-compatibility-with-mysql.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,29 @@ aliases: ['/docs/dev/security-compatibility-with-mysql/','/docs/dev/reference/se

TiDB supports similar security functionality to MySQL 5.7, with the following exceptions:

- Only the `mysql_native_password` password-based and certificate-based authentication is supported
- External authentication (such as with LDAP) is not currently supported
- Column level permissions are not supported
- Password expiry, as well as password last-changed tracking and password lifetime are not supported [#9709](https://github.com/pingcap/tidb/issues/9709)
- The permission attributes `max_questions`, `max_updated`, `max_connections`, `max_user_connections` are not supported
- Password validation is not currently supported [#9741](https://github.com/pingcap/tidb/issues/9741)

## Authentication plugin status

TomShawn marked this conversation as resolved.
Show resolved Hide resolved
TiDB supports multiple authentication methods. These methods can be specified on a per user basis using [`CREATE USER`](/sql-statements/sql-statement-create-user.md) and [`ALTER USER`](/sql-statements/sql-statement-create-user.md). These methods are compatible with the authentication methods of MySQL with the same names.

You can use one of the following supported authentication methods in the table. To specify a default method that the server advertises when the client-server connection is being established, set the [`default_authentication_plugin`](/system-variables.md#default_authentication_plugin) variable.

The support for TLS authentication is configured differently. For detailed information, see [Enable TLS between TiDB Clients and Servers](/enable-tls-between-clients-and-servers.md).

| Authentication Method | Supported |
| :------------------------| :--------------- |
| `mysql_native_password` | Yes |
| `sha256_password` | No |
| `caching_sha2_password` | Yes, since 5.2.0 |
| `auth_socket` | No |
| [TLS Certificates] | Yes |
| LDAP | No |
| PAM | No |
| ed25519 (MariaDB) | No |
| GSSAPI (MariaDB) | No |

[TLS Certificates]: /enable-tls-between-clients-and-servers.md
7 changes: 7 additions & 0 deletions system-variables.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,6 +128,13 @@ mysql> SELECT * FROM t1;
- This variable indicates the location where data is stored. This location can be a local path or point to a PD server if the data is stored on TiKV.
- A value in the format of `ip_address:port` indicates the PD server that TiDB connects to on startup.

### default_authentication_plugin

- Scope: GLOBAL
- Default value: `mysql_native_password`
- This variable sets the authentication method that the server advertises when the server-client connection is being established. Possible values for this variable are documented in [Authentication plugin status](/security-compatibility-with-mysql.md#authentication-plugin-status).
- Value options: `mysql_native_password` and `caching_sha2_password`. For more details, see [Authentication plugin status](/security-compatibility-with-mysql.md#authentication-plugin-status).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Follow up: add "since v5.2" back once the release-5.2 branch is available.


dveeden marked this conversation as resolved.
Show resolved Hide resolved
### ddl_slow_threshold

- Scope: INSTANCE
Expand Down